Exfiltration via base64 JSON in X-Request-Id header to fake Injective gRPC-Web endpoint

Ethan Andrews@eandrews

•updated Jul 9, 2026•10•0•21

Detects outbound POST requests using the grpc-web+proto content type where the X-Request-Id header contains a base64-encoded JSON blob. This pattern is associated with exfiltrating sensitive data, such as mnemonic phrases or private keys, to a malicious endpoint masquerading as an Injective testnet gRPC-web node.