ChainScript WebSocket C2 via X-Agent-Token header

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•2

Detects outbound network activity associated with the ChainScript malware family, including WebSocket C2 communication identified by a specific 'X-Agent-Token' header and TLS connections to known rotating command-and-control domains.