VPN for X extension beacon to rutracker.org and VIP subscription API

Ankit Mehta@Secvyn

•updated 6 days ago•0•0•0

Detects browser-side network activity involving known command-and-control or subscription API domains associated with a malicious VPN browser extension proxy campaign. The rule monitors for beaconing behavior from popular web browsers (Chrome, Edge, Brave) to specific domains utilized by the campaign.