Operation Turb00: Correlated browser credential theft, screen capture, keylogging, and staged archiving (Vidar/SnappyClient)

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•6

Detects a sequence of suspicious activities characteristic of information-stealing malware (e.g., Vidar/SnappyClient). The rule correlates browser credential access (Login Data/Cookies), screen capturing (GDI API calls), and keylogging (SetWindowsHookEx) with subsequent archive staging activities (compression of sensitive data in temp folders) within a one-hour window.