Bluekit PhaaS credential exfiltration via Telegram API and known C2 domains

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

This rule identifies suspicious outbound network traffic potentially related to data exfiltration or command-and-control (C2) communication. It monitors for connections to the Telegram Bot API utilizing 'sendMessage' methods, often used by malware for exfiltrating credentials or sensitive data, as well as connections to known 'Bluekit' PhaaS (Phishing-as-a-Service) operator domains.