@withgoogle/stitch-sdk Scope Squat: C2 Contact and Browser Credential Access

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects instances where a node.exe process attempts to open sensitive browser files such as 'Login Data' or 'Cookies', which are common targets for credential theft. Additionally, it monitors for network communication (DNS requests or HTTP connections) to the domain 'stitch-production.org', which may be a command and control (C2) endpoint.