ClickFix: StealC Credential/Session Exfiltration POST to Known C2 Infrastructure

Arnold Chan@slaz

•updated Sep 18, 2026•0•0•1

Detects network indicators associated with the StealC information stealer, including DNS lookups for identified C2 domains, HTTPS traffic to known C2 endpoints, and suspicious POST requests using multipart/form-data indicative of credential or session data exfiltration.