178[.]236[.]252[.]161

Posts referencing this indicator

• Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates

  Socket

  C2 server for Firefox extension version 1.3.3; used for clipboard exfiltration and proxy-location retrieval

  2026-07-02