Secret string exfiltrated over raw TCP via netcat to ngrok tunnel

Emiliano Mema@Nosalva

•updated Jul 16, 2026•0•0•3

Detects outbound network traffic containing the specific string 'Secret: ' using raw TCP, often indicative of data exfiltration or unauthorized command-and-control communication via tunneling tools like netcat or ngrok.