Secret exfiltration via HTTP POST to webhook.site

Duo Tech@duotech

•updated Jul 15, 2026•0•0•6

Detects outbound HTTP POST requests destined for 'webhook.site' containing the string 'secret' in the request body. This is a common pattern used by attackers to exfiltrate small amounts of sensitive data or credentials to a public web service for collection.