Polymarket Trap Miasma C2 Exfiltration to Vercel and stitch-production.org

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects outbound network connections from internal hosts to domains associated with the Polymarket Trap / Miasma infostealer campaign, including dedicated servers (stitch-production.org, log-taker.store) and vercel.app serverless endpoints used for credential exfiltration.