Amadey Loader Downloading StealC from Self-Hosted GitLab Raw File URLs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects network activity and process execution patterns associated with the Amadey loader and Operation FlutterBridge. The rule monitors for unauthorized file downloads from self-hosted GitLab repositories using raw paths, delivery of malicious archives like 'protected.zip', and the execution of common downloaders (PowerShell, cmd, curl, wget) triggered by known Amadey process artifacts (Yfgfwb.exe).