Non-browser process accessing Gmail then Telegram API (VOLTA receipt enrichment)

ills3c Intel&Coffee@Ills3C

•updated 5 days ago•2•0•9

Detects non-browser processes communicating with both mail.google.com and api.telegram.org within a 60-minute window, which may indicate automated email exfiltration via Telegram using stolen session cookies.