Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Exfiltration/ T1567

T1567Exfiltration Over Web Service

T1567 — Exfiltration Over Web Service is a MITRE ATT&CK technique in the Exfiltration tactic. Clankerusecase tracks 71 detection use cases covering it and 48 threat-intel articles citing it.

Exfiltration
View on the matrix → Filter Detection Library MITRE official spec ↗
71Use cases
48Articles
4Sub-techniques
1Tactic

Sub-techniques (4)

T1567.004 · Exfiltration Over WebhookT1567.002 · Exfiltration to Cloud StorageT1567.001 · Exfiltration to Code RepositoryT1567.003 · Exfiltration to Text Storage Sites

Use cases covering this technique (71)

Application data exfiltration successful Internal actions · alerting DD [WEEKLY] Install-Triggered Registry Publish or Git Push (Supply-Chain Worm Self-Propagation) Internal actions · alerting DSPDDCSCW [WEEKLY] Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes Internal actions · alerting DSPDD [WEEKLY] npm Install-Time Lifecycle Hook Triggers Outbound Egress to Newly-Seen Domain (Shai-Hulud/Miasma/IronWorm pattern) Internal install · alerting DSPDD [WEEKLY] Package-manager child process credential fan-out with public egress (Mini Shai-Hulud / TeamPCP worm chain) Internal install · alerting DSPDD [WEEKLY] Package-Manager Install -> Interpreter Child -> Non-Registry Egress Within 5 Minutes Internal install · alerting DSPDD [WEEKLY] Package-manager install-time interpreter spawn with credential-file read and outbound egress within 120s Internal install · alerting DSPDD [WEEKLY] SSRF-Driven Secret Egress: Public-Facing App Reaches Cloud Metadata/Attacker Host Internal actions · alerting DSΣPDDCSCW [WEEKLY] Supply-chain repo credential theft → outbound exfil to attacker infra Internal actions · alerting DSPDD O365 DLP Rule Triggered ESCU actions · hunting P O365 Email Access By Security Administrator ESCU actions · alerting P O365 Exfiltration via File Access ESCU actions · hunting P O365 Exfiltration via File Download ESCU actions · hunting P O365 Exfiltration via File Sync Download ESCU actions · hunting P Linux Gdrive Binary Activity ESCU actions · alerting P LOLBAS With Network Traffic ESCU actions · alerting P Windows Gdrive Binary Activity ESCU actions · alerting P Cisco TFTP Server Configuration for Data Exfiltration ESCU actions · alerting P High Volume of Bytes Out to Url ESCU actions · hunting P Splunk Data exfiltration from Analytics Workspace using sid query ESCU actions · hunting P [LLM] Endpoint egress/DNS to anonfilesnew.com anonymous file host (TheHatman sample staging) Bespoke actions · hunting DSΣPDDCS [LLM] conflibot post-injection secret exfiltration: token grab by git/shell child on CI runner (CVE-2026-55158) Bespoke actions · hunting DSΣPDDCS [LLM] TeamPCP CI/CD credential-stealer C2 egress to 83.142.209.203 / checkmarx.zone Bespoke c2 · hunting DSΣPDDCSCW [LLM] JWR phishing kit exfiltration & instruction API endpoints (/api/open/the_final_interface, addCvv) Bespoke actions · alerting DSΣP [LLM] anthropickit exfiltration POST to Pipedream endpoint (enqqnvvtgrnyl.x.pipedream.net) Bespoke actions · alerting DSΣPCS [LLM] flyto-verification runner egress to external public host — FLYTO_RUNNER_SECRET exfiltration Bespoke actions · hunting DSPDDCS [LLM] Budibase server leaks datasource auth to first-seen host (undici + Authorization egress) Bespoke actions · hunting SP [LLM] Network egress from CI/build host to GhostAction secret-exfil infrastructure Bespoke c2 · hunting DSΣPDDCS [LLM] CI runner process POSTing secrets to GhostAction exfil host via curl/wget/node Bespoke actions · alerting DSΣPDDCS [LLM] Shai-Hulud credential exfiltration: node/npm outbound to webhook.site Bespoke actions · alerting DSΣPDDCS [LLM] Injective SDK wallet-key exfil to lookalike domain testnet.archival.chain.grpc-web.injective.network Bespoke actions · alerting DSΣPDDCS [LLM] First-seen external egress from GitHub Actions Runner.Worker child process Bespoke actions · hunting DSPCS [LLM] Developer-runtime exfiltration to webhook.site (Shai-Hulud token drop) Bespoke actions · alerting DSΣPDDCS [LLM] Exfiltration to attacker-controlled Sentry ingest endpoint (onering crate) Bespoke actions · alerting DSΣPDDCS [LLM] Rust build script making outbound network connection (build-time exfil) Bespoke c2 · hunting DSΣPDDCS [LLM] node child of npm install initiating outbound network to non-registry destination Bespoke c2 · hunting DSPDDCS [LLM] Mini Shai-Hulud npm worm exfil to filev2.getsession.org Bespoke actions · alerting DSPDDCS [LLM] postmark-mcp BCC exfil to giftshop.club Bespoke actions · alerting DSΣPDDCS [LLM] DNS/HTTPS exfil to sentry.anyclaw.store (Codex token C2 masquerading as Sentry) Bespoke c2 · alerting DSΣPDDCS [LLM] Mini Shai-Hulud npm worm C2/exfil egress (masscan.cloud, git-tanstack.com, getsession.org) Bespoke actions · alerting DSΣPDDCS [LLM] Megalodon CI/CD exfil: outbound HTTPS to C2 216.126.225.129:8443 Bespoke c2 · hunting DSΣPDDCS [LLM] DNS / Network egress to TeamPCP Nx Console C2 domain check.git-service.com Bespoke c2 · alerting DSΣPDDCS [LLM] Outbound C2 to t.m-kosche.com from CI/CD runner or any endpoint Bespoke c2 · alerting DSΣPDDCS [LLM] Mini Shai-Hulud GitHub dead-drop exfiltration via python-requests/2.31.0 Bespoke actions · hunting DSΣPDDCS [LLM] Mini Shai-Hulud npm Worm C2 callback to Session Protocol CDN and masscan.cloud Bespoke c2 · alerting DSΣPDDCS [LLM] Shai-Hulud style repository poisoning — .claude/router_runtime.js drop Bespoke actions · alerting DSΣPDD [LLM] Mini Shai-Hulud 'OhNoWhatsGoingOnWithGitHub' dead-drop keyword in outbound URL Bespoke c2 · alerting DSΣPDD [LLM] Svix Ingest webhook exfiltration relay (src_3387PLMB2uhXOBe3Q8sHu) Bespoke exfiltration · alerting DSΣPDDCS [LLM] Mini Shai-Hulud post-compromise persistence artifacts in .claude/, .vscode/, .github/workflows/ Bespoke actions · alerting DSΣPDD [LLM] Exfil to skyhanni.cloud C2 with X-Rise-To-The-Trinny header Bespoke c2 · alerting DSΣPDDCS [LLM] Suspicious draft email manipulation against barrantaya.1010@outlook.com (BoxOfFriends Graph API C2) Bespoke c2 · hunting DSPDDCS [LLM] Shai-Hulud preinstall: node/npm spawning git/curl/gh pushing to attacker repo or GitHub API Bespoke actions · hunting DSPDDCS [LLM] hackerbot-claw payload host: DNS/HTTP egress to hackmoltrepeat.com (C2 + exfil) Bespoke c2 · alerting DSΣPDDCS [LLM] hackerbot-claw token exfiltration: curl POST with GITHUB_TOKEN to recv.hackmoltrepeat.com Bespoke actions · alerting DSΣPDDCS [LLM] Trivy supply-chain C2 beacon to typosquat domain scan.aquasecurtiy.org Bespoke c2 · alerting DSΣPDD [LLM] DNS tunneling exfiltration pattern to *.t.opentensor-cdn.com (hex chunk/index/total/session) Bespoke c2 · alerting DSΣPDD [LLM] C2 beaconing to Vercel-hosted Cloudflare-impersonating domains (cloudflareguard / cloudflareinsights) Bespoke c2 · alerting DSΣPDD [LLM] Outbound traffic to *.oastify.com (BurpSuite Collaborator) from corporate endpoint Bespoke exfiltration · alerting DSΣPDDCS [LLM] Egress to Qix npm phishing/exfil infrastructure (npmjs.help, publicvm.com, BunnyCDN buckets) Bespoke c2 · hunting DSΣPDDCS [LLM] GhostChat C2 beacon URL pattern: hitpak.org/page.php?tynor=<host>sss<user> Bespoke exfil · alerting DSΣPDDCS [LLM] Shai-Hulud 3.0 'Goldox-T3chs' GitHub exfiltration marker observed Bespoke actions · alerting DSΣPDDCS [LLM] Outbound exfiltration to webhook.site from npm / node / bun process tree Bespoke c2 · alerting DSΣPDDCS [LLM] Outbound email BCC'd to giftshop.club exfil domain (postmark-mcp backdoor) Bespoke actions · alerting DSΣPDD [LLM] DNS or HTTP egress to giftshop.club exfil domain Bespoke c2 · alerting DSΣPDDCS [LLM] Shai-Hulud worm C2 exfiltration to webhook.site UUID bb8ca5f6 Bespoke c2 · alerting DSΣPDDCS [LLM] Egress to websocket-api2.publicvm.com (Qix campaign credential exfil C2) Bespoke c2 · alerting DSΣPDDCS [LLM] Discord webhook / CDN exfiltration from non-browser process (Empyrean stealer C2) Bespoke actions · hunting DSPDDCS [LLM] npm dropper exfiltration to pkgio.com telemetry server Bespoke exfil · alerting DSΣPDDCS [LLM] SourMint/Mintegral SDK covert click-data exfiltration to n.systemlog.me Bespoke actions · alerting DSΣPCS [LLM] Agama wallet C2/exfil callback to updatecheck.herokuapp.com (electron-native-notify) Bespoke c2 · alerting DSΣPDDCS [LLM] Copay wallet-stealer C2 exfil to copayapi.host / 111.90.151.134 Bespoke c2 · hunting DSΣPDDCS

Articles citing this technique (48)

high Hacker claims 3.6 million Azure account records stolen from major companies art-06
crit [GHSA / CRITICAL] CVE-2026-55158: conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target art-18
crit Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List. art-35
crit Dissecting the JWR phishing framework art-60
crit Anthropic's Fever Dream: Claude's package that stole real keys art-156
crit [GHSA / CRITICAL] CVE-2026-67426: Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltr art-167
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
crit [GHSA / CRITICAL] GHSA-mqhr-6j6h-74p5: Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak art-199
high Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization art-221
high How Aikido Intel detects malware and vulnerabilities first art-284
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-291
high simonecorsi/mawesome GitHub Action has been compromised art-330
high Prevent npm and Python Supply Chain Attacks on Developer Machines with Package Configs art-363
crit Compromised Rust crate onering performs code exfiltration art-392
crit Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm art-425
high What MDM can't protect on developer machines (and what to do about it) art-432
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-434
high Why developer machines are now the number one target for supply chain attacks art-442
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-447
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-458
med actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials art-472
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-474
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-483
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-511
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-513
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-515
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-520
crit GopherWhisper: A burrow full of malware art-529
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-562
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-570
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-593
crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-594
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-596
crit Sednit reloaded: Back in the trenches art-629
high How “Clinejection” Turned an AI Bot into a Supply Chain Attack art-661
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-673
med Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan art-719
high The Holiday Whisper: Shai-Hulud 3.0 art-751
high SHA1-Hulud, npm supply chain incident art-796
high Malicious MCP Server on npm postmark-mcp Harvests Emails art-867
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-875
high npm Supply Chain Attack via Open Source maintainer compromise art-878
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2095
crit Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks art-2226
high SourMint malicious SDK research writeup art-3336
high Yet another malicious package found in npm, targeting cryptocurrency wallets art-3533
high Malicious code found in npm package event-stream downloaded 8 million times in the past 2.5 months art-3608