EKZ Stealer Credential Exfiltration to 83.138.53.110/service/save.php

Ibrahim Saud@tektrix

•updated Jul 3, 2026•2•0•6

Detects potential exfiltration activity involving PowerShell scripts interacting with a specific remote IP address, using System.Net.WebClient to upload file contents, and referencing a common local staging file (C:\ProgramData\log.txt).