Amadey HTTP GET to self-hosted GitLab bzctoons.net for StealC protected.zip

Duo Tech@duotech

•updated Jun 30, 2026•0•0•1

Detects HTTP GET requests to a specific self-hosted GitLab domain 'gitlab.bzctoons.net' that attempt to download a file named 'protected.zip', which is associated with the retrieval of StealC information-stealing malware by the Amadey loader.