Potential GoldMelody ViewState Deserialization Activity

Yolanda Icepa@yicepa

•updated Jul 16, 2025•0•22

Detects HTTP POST requests containing suspicious parameters or headers used by GoldMelody's in-memory IIS modules. Attackers leverage ASP.NET ViewState deserialization to execute payloads in memory, often passing commands and data via non-standard HTTP parameters and headers within POST requests.