[LastPass-Delphos] GitHub Distribution Network - SEO Lure to albinofennel.com MaaS Payload with 100MB+ ZIP Evasion

Ankit Mehta@Secvyn

•updated Sep 18, 2026•0•0•2

This rule detects potential malware delivery by correlating network visits to known malicious domains used for lure distribution with subsequent large file downloads (.zip files >= 100MB) in typical user download or temporary folders within a short time window. This pattern is characteristic of campaigns leveraging social engineering and file-based evasive techniques (such as padding to bypass static analysis) to distribute malicious payloads.