Post-ClickFix Stealer Execution with Rapid C2 Beacon and Browser/Wallet Data Access

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•8

This rule detects a multi-stage attack pattern involving the execution of PowerShell via explorer.exe, followed by subsequent sub-process activity that attempts to access sensitive browser-stored credentials (Login Data or Cookies) or specific cryptocurrency wallet data, combined with a concurrent network connection attempt, indicative of credential exfiltration via a command-and-control (C2) beacon.