title: 'T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2'
id: '364fbafd-91fb-4816-9dc9-be90b870f0fb'
status: 'experimental'
description: 'The client-to-server channel of the ShinyHunters "The Com" claims-impersonation kit. Unlike the Telegram-relay kits that dominate this ecosystem, this variant exfiltrates first-party: captured credentials and MFA codes are POSTed to the kit''s own origin over a compact set of single-letter routes (/e login and OTP, /w captcha returning the panel type, /z operator status, plus /d /y /m /u /x), with bodies sent as Content-Type text/plain carrying the header X-Enc: 1 and a base64 payload. The payload is not encrypted in any meaningful sense — it is a byte-wise XOR against a 32-byte keystream derived from the _fbc Meta Pixel click-identifier cookie the page sets, so a defender with the request and the cookie recovers the plaintext offline. This rule matches the X-Enc header on a POST (the strongest single indicator, as the header is specific to this kit) and, separately, a POST of a text/plain body to one of the single-letter routes served by a Next.js asset host. The routes alone are generic; require the text/plain body or the X-Enc header to scope. Because the exfil is first-party rather than to Telegram, a Telegram-based detection will not see this kit — this channel is its strongest discriminator.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1557/'
    - 'https://attack.mitre.org/techniques/T1027/013/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.credential_access'
    - 'attack.t1557'
    - 'attack.exfiltration'
    - 'attack.defense_evasion'
    - 'attack.t1027.013'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_xenc_header:
        cs-method: 'POST'
        X-Enc: '1'
    selection_singleletter_textplain:
        cs-method: 'POST'
        cs-content-type|contains: 'text/plain'
        cs-uri-stem:
            - '/e'
            - '/w'
            - '/z'
            - '/d'
            - '/y'
            - '/m'
            - '/x'
    condition: 'selection_xenc_header or selection_singleletter_textplain'
falsepositives:
    - 'Applications that legitimately POST text/plain bodies to short API routes. The single-letter paths are generic; keep them paired with the text/plain content type, and where possible add the requirement that the host is not a sanctioned application. The X-Enc header selection is specific to this kit and should rarely false-positive.'
    - 'Beacon, telemetry, or analytics endpoints that use single-character paths. Allowlist the known destinations rather than removing the route list.'
    - 'Proxy or WAF products that do not log request headers will not populate the X-Enc field; in those environments rely on selection_singleletter_textplain and confirm at the host.'
level: 'high'