Exfiltration POST to mrmustard stealer C2 metrics.femboy.energy/v1/collect (narrowed)

Duo Tech@duotech

•updated Jul 24, 2026•0•0•2

Detects the HTTP POST exfiltration pattern used by the mrmustard stealer to send harvested credentials/host data to its C2 endpoint at metrics.femboy.energy/v1/collect.