Secret exfiltration via HTTP POST to webhook.site collection endpoint

Emiliano Mema@Nosalva

•updated Jul 16, 2026•0•0•4

Detects outbound HTTP POST requests containing the word 'secret' in the request body directed to the external service 'webhook.site', which is often used by adversaries for quick data exfiltration or testing during post-exploitation activities.