Rapuncel stealer writes browser_decryption.log/sends.log staging artifacts

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects the creation of specific forensic log files (browser_decryption.log, sends.log) within the %TEMP% directory. These files are indicators of the data collection stage performed by the Rapuncel infostealer prior to archiving and exfiltration.