GemStone GemStone Extension C&C TLS SNI to extension-management-portal Workers Domain

Ankit Mehta@Secvyn

•updated Sep 10, 2026•0•0•0

Detects network traffic associated with the GemStone malicious browser extension, including initial registration to a command-and-control (C2) server on Cloudflare Workers, periodic heartbeat beacons, command polling, and external public IP address lookups for victim identification.