Oky Thief -

rule OkyThief_Stealer meta: description = "Detects Oky Thief payloads" author = "CTIR" date = "2026-04-17" strings: $s1 = "OkyStealer" wide ascii $s2 = "clipboard hook activated" fullword ascii $s3 = "discord.com/api/webhooks" ascii $s4 = "http://oky-stats.top" ascii condition: uint16(0) == 0x5A4D and (any of ($s*))

| Type | Indicator | Description | |------|-----------|-------------| | Domain | oky-stats[.]top | C2 / exfiltration server | | Domain | cdn-discord[.]com (spoofed) | Fake Discord CDN | | URL | hxxp://45.155.205[.]233/oky/log | Logging endpoint | | JA3 | e7d705a4b6eab7b1e2b4c3d5f6a7b8c9 | TLS fingerprint of Oky C2 | oky thief

Based on the search results, "Oky" generally refers to a reputable UNICEF-supported period tracker app designed for girls. However, a search for "Oky thief" brings up several different possibilities, ranging from security tools to unrelated gaming applications. rule OkyThief_Stealer meta: description = "Detects Oky Thief