CountLoader C2: /connect XOR-hex beacon followed by JWT Bearer reuse in same process

Duo Tech@duotech

•updated Aug 6, 2026•3•0•0

Detects a CountLoader command-and-control pattern where a process issues an HTTP GET to a /connect endpoint with XOR-hex-style query parameters, followed within one hour by an Authorization: Bearer JWT token reused by the same process, host, and agent.