VPN Go Clipboard Stealer - Proxy/Exfil over Plaintext HTTP to IOC Hosts

Lourenço Santos@lourenco

•updated Jun 30, 2026•0•0•2

Detects plaintext HTTP (no TLS) requests to known VPN Go campaign hosts, covering both the clipboard exfiltration endpoint and the /locations proxy-location endpoint. Useful where proxy logs carry the Host header.