[Lidador]

Like many, I use UFW. I wonder if there is a way to have a "pop-up ask for new outbound connection" acceptance per program running.

[aendruk]

Note that this exfiltrated via DNS queries so it may actually be your local resolver making the connection.

[VTimofeenko]

OpenSnitch might fit the bill

[npteljes]

I use OpenSnitch for this - it works exactly as you describe.