RevStealer C2 exfiltration via vpugy.vcqi endpoints with spoofed Chrome UA

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects outbound HTTP POST requests to the 'vpugy.vcqi' domain, which is associated with RevStealer malware exfiltration. The rule specifically looks for traffic using a spoofed Chrome/147 user-agent and specific cookie artifacts used for session tracking in the exfiltration communication.