CRPx0 pre-encryption exfiltration via CrpxBoundary multipart upload to relay.php

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•2

Detects HTTP POST requests directed at 'relay.php' containing a specific 'CrpxBoundary' in the request body and an 'Authorization' header with the value 'Bearer crpx0_c2_2026'. This pattern is indicative of the CRPx0 malware exfiltrating data in chunks over an established C2 channel.