ThiefQuest exfiltrates targeted file extensions in the "/Users/" folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.