Blog

HUD Padlock Icon Cyber Security, Digital Data Network Protection, Future Technology Digital Data Network Connection Background Concept. 3d rendering

<p><br>Phishing-as-a-Service (PhaaS) platforms have emerged as a significant concern in the cyber secutiy space. Among them, Darcula stands out as a particularly dangerous entity, leveraging advanced technologies to democratize cybercrime and escalate phishing attacks worldwide.</p><figure id="figure-of5scf8asqmaeeiqfl"><img id="of5scf8asqmaeeiqfl" src="https://media.gettyimages.com/id/2151633407/photo/threat-phishing-malicious-danger-hack-warning-mail-thief-scam-alert-safety-letter-technology.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8qOEdVVtrcoBXOj76y6b8ujfyEYhUHdpxhf1SeViRQw=" alt="Threat, phishing, malicious, danger, hack, warning, mail, thief, scam, alert, safety, letter, technology, online, Cyber crime security concept, Alert Email inbox and spam virus with warning caution." title="Threat, phishing, malicious, danger, hack, warning, mail, thief, scam, alert, safety, letter, technology, online, Cyber crime security concept, Alert Email inbox and spam virus with warning caution." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2151633407/photo/threat-phishing-malicious-danger-hack-warning-mail-thief-scam-alert-safety-letter-technology.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8qOEdVVtrcoBXOj76y6b8ujfyEYhUHdpxhf1SeViRQw=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>What is Darcula?</h3><p>Darcula is a Chinese-language PhaaS platform that has revolutionized phishing. It offers an all-in-one suite to launch sophisticated phishing campaigns with minimal effort. Subscribers gain access to over 200 customizable templates impersonating global brands, including postal services, financial institutions, and government agencies. The platform's user-friendly interface allows even non-technical individuals to deploy phishing sites rapidly.</p><h3>Why Darcula is Particularly Dangerous</h3><ul><li><strong>Ease of Use: </strong>Darcula's simple design lowers the barrier to entry for cybercriminals. Users can simply input the URL of a legitimate website, and the platform clones it, enabling the insertion of malicious content without any coding knowledge. This automation allows individuals with minimal technical skills to execute complex phishing attacks.</li><li><strong>Scalability: </strong>The platform supports mass deployment of phishing campaigns across various channels, including SMS, iMessage, and Rich Communication Services (RCS). By utilizing these messaging services, Darcula can bypass traditional SMS firewalls, increasing the reach and effectiveness of its campaigns.</li><li><strong>Advanced Technology Integration: </strong>Darcula employs modern technologies such as JavaScript, React, Docker, and Harbor, mirroring the infrastructure of legitimate SaaS companies. This sophisticated setup enhances the platform's reliability and scalability, making it a powerful tool in the hands of cybercriminals.</li><li><strong>Generative AI Capabilities: </strong>Recently Darcula has integrated generative AI into its toolkit. This feature allows for the automatic creation of phishing pages in multiple languages, complete with customizable forms and localized translations. The AI-assisted functionality enables rapid deployment of tailored phishing sites, further lowering the technical threshold for attackers.</li></ul><h3>Real-World Impact</h3><p>Darcula's operations have had a profound global impact. Between 2023 and 2024, the platform was responsible for stealing 884,000 credit card numbers through phishing texts, resulting from 13 million clicks on malicious links. Its reach spans over 100 countries, with phishing domains impersonating various services. The platform's ability to target both Android and iPhone users via SMS, iMessage, and RCS has made it a critical threat.</p><h3>Implications for Businesses and Users</h3><p>The rise of platforms like Darcula signifies a shift in the cyber threat landscape, where sophisticated phishing tools are readily accessible to a broader range of attackers. Businesses must recognize the heightened risk and adapt their security measures accordingly. Traditional defenses may no longer suffice against such advanced threats.</p><h3>How to Defend Against Darcula-Based Phishing</h3><p><strong>Technical Measures:</strong></p><ul><li><strong>Advanced Filtering:</strong> Implement real-time threat intelligence and advanced email/SMS filtering systems to detect and block phishing attempts.</li><li><strong>Multi-Factor Authentication (MFA):</strong> Enforce MFA across all user accounts to add an extra layer of security.</li></ul><p><strong>Behavioral Strategies:</strong></p><ul><li><strong>User Education:</strong> Conduct regular training sessions to help users identify phishing attempts, such as unexpected messages or unfamiliar links.</li><li><strong>Reporting Mechanisms:</strong> Establish clear protocols for reporting suspicious communications to enable swift action.<br data-mce-bogus="1"></li></ul><figure id="figure-mra24pues6maeejfgj"><img id="mra24pues6maeejfgj" src="https://media.gettyimages.com/id/1322517295/photo/cyber-security-it-engineer-working-on-protecting-network-against-cyberattack-from-hackers-on.jpg?b=1&s=2048x2048&w=0&k=20&c=KYzhQhnqvXMZtH6W_hI7fF0vHzWshl5_m-1X31NgDTw=" alt="Cyber security IT engineer working on protecting network against cyberattack from hackers on internet. Secure access for online privacy and personal data protection. Hands typing on keyboard and PCB" title="Cyber security IT engineer working on protecting network against cyberattack from hackers on internet. Secure access for online privacy and personal data protection. Hands typing on keyboard and PCB" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h3>Conclusion</h3><p>Darcula exemplifies the growing trend of cybercrime-as-a-service, where advanced tools are made accessible to a wider audience. The integration of AI into phishing platforms marks a significant escalation in the threat landscape. It is imperative for organizations and individuals to stay informed, adopt robust security measures, and foster a culture of vigilance to counteract these evolving threats. If your company has concerns about phising threats, visit our "Contact Us" page. With our vCISO service we can provide you with email phising monitoring services as well as real-time networking montoring to both prevent and respond to breaches.&nbsp;</p>

Darcula: The AI-Powered Phishing Platform Fueling a Global Cybercrime Surge

Cyber threat from North Korea. North Korean hacker at the computer, on a background of binary code, the colors of the flag of the DPRK. DDoS attack

<p>North Korean state-backed hackers are once again turning job seekers into unwitting victims. In a new campaign tracked as Contagious Interview, attacks pose as recruiters from fake crypto consulting firms to lure candidates into malware traps. Unlike previous efforts focused on phishing or exploiting crypto tools directly, this one weaponizes the hiring process itself.</p><h2>Fake Interviews, Real Malware</h2><p><br>Researchers at Silent Push have identified a set of front companies—BlockNovas LLC, Angeloper Agency, and SoftGlide LLC—being used by threat actors to distribute malware through fake job interviews. These aren’t just spoofed profiles or short-lived websites. The companies have full online personas, complete with fabricated employee profiles, websites claiming years of experience, and active presences on LinkedIn, GitHub, and even Medium.</p><p>Candidates are tricked during the hiring process, often being asked to complete coding tasks or “fix browser issues” related to their video assessments. In reality, these tasks are a cover for delivering cross-platform malware. Three distinct malware families—BeaverTail, InvisibleFerret, and OtterCookie—have been identified as part of the campaign. These can exfiltrate credentials, take screenshots, and provide long-term backdoor access.</p><figure id="figure-ems1nt52shmac01rs1"><img id="ems1nt52shmac01rs1" src="https://media.gettyimages.com/id/1307598870/photo/male-indian-hr-recruiter-or-employer-holding-cv-having-online-virtual-job-interview-meeting.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=KaiE_KHDHqfWSc_Zj3PI_fxVzExQFawu3jreCysaaHg=" alt="Male indian hr, recruiter or employer holding cv having online virtual job interview meeting with african candidate on video call. Distance remote recruitment conference chat. Over shoulder view." title="Male indian hr, recruiter or employer holding cv having online virtual job interview meeting with african candidate on video call. Distance remote recruitment conference chat. Over shoulder view." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1307598870/photo/male-indian-hr-recruiter-or-employer-holding-cv-having-online-virtual-job-interview-meeting.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=KaiE_KHDHqfWSc_Zj3PI_fxVzExQFawu3jreCysaaHg=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Why Is North Korea Doing This?</h2><p><br>This operation is more than a cybercrime scheme—it’s a state-funded campaign designed to serve two strategic goals: raise money for the regime and steal intellectual property.</p><p>The Democratic People's Republic of Korea (DPRK) is under heavy international sanctions and relies heavily on illicit cyber operations to fund its government. Cybersecurity experts have consistently tracked activity that blends financial theft with espionage, and campaigns like Contagious Interview fit squarely within that pattern.</p><p>In addition to deploying malware, North Korea has used these fake hiring efforts to gather intelligence on companies and their technologies, particularly in the blockchain and fintech sectors. In some cases, they’ve even gotten job applicants to run malware that compromised cryptocurrency wallets like MetaMask.</p><h2>Ties to a Broader Social Engineering Network</h2><p><br>Contagious Interview is one part of a wider ecosystem of North Korean social engineering operations. Another campaign known as Wagemole involves crafting AI-generated personas to gain legitimate employment in Western tech firms. These fake workers often pass interviews using highly coordinated playbooks and tools, then quietly work remote jobs while sending portions of their salaries back to Pyongyang.</p><p>GenAI-powered services are now being used to streamline every part of this process. From scheduling interviews to transcribing calls and translating real-time conversations, the operation is becoming more automated and scalable. Researchers note that a small group of facilitators often control multiple fake identities, juggling several job applications at once.</p><p><br></p><figure id="figure-t8obhcgskmac065l6"><img id="t8obhcgskmac065l6" src="https://media.gettyimages.com/id/1502418564/photo/black-hat-hacker-in-hood-using-laptop-computer-and-call-smartphone-to-victim-on-desk-hacking.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=qw-g96lux6Dw6_w7l74aNoLyPSASdLvWWiPni7NIMno=" alt="Black hat hacker in hood using laptop computer and call smartphone to victim on desk hacking privacy sensitive data hack in dark room background. Cyber security cyber crime concept. Hacking phishing" title="Black hat hacker in hood using laptop computer and call smartphone to victim on desk hacking privacy sensitive data hack in dark room background. Cyber security cyber crime concept. Hacking phishing" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1502418564/photo/black-hat-hacker-in-hood-using-laptop-computer-and-call-smartphone-to-victim-on-desk-hacking.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=qw-g96lux6Dw6_w7l74aNoLyPSASdLvWWiPni7NIMno=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Infrastructure and Obfuscation</h2><p><br>Much of the technical infrastructure for this campaign is intentionally anonymized. The attackers use VPN services like Astrill, residential proxies, and even password-cracking tools like Hashtopolis hosted on their fake domains. One subdomain tied to BlockNovas was found running a status dashboard monitoring their broader infrastructure, including sites like lianxinxiao.com and angeloperonline.online.</p><p>These connections were traced to IP ranges in Russia, particularly in the Khasan and Khabarovsk regions—areas known for proximity and ties to North Korea. While it’s not confirmed whether the Russian infrastructure providers are cooperating directly, it suggests some level of facilitation or indirect support.</p><h2>Mitigating the Threat</h2><p><br>There is no single fix for this threat, but awareness is a strong starting point. Hiring managers, HR teams, and technical leads must be trained to spot red flags in the recruitment process. Be cautious when asked to download unfamiliar tools during interviews or when interacting with companies that have little verifiable history.</p><p>Organizations should also implement stronger endpoint protections. Staff—especially developers—should not have unrestricted ability to install software, particularly during onboarding or interviews. Activity monitoring, restricted permissions, and application allowlisting are effective safeguards.</p><p>Finally, verify the legitimacy of vendors and applicants alike. Use open-source intelligence tools to check domain histories, employee photos, and company claims. If a firm says it’s been around for 12 years but was registered 6 months ago, that’s a serious red flag.</p><h2>The Bottom Line</h2><p><br>The fake interview lure represents a chilling evolution in North Korean cyber tactics. By turning the hiring process into an attack vector, these threat actors are able to bypass traditional security tools and get closer to valuable targets.</p><p>It’s a reminder that in today’s cyber threat landscape, even a job interview can be a front for state-sponsored malware. Vigilance, verification, and education are your first lines of defense.</p>

North Korean Hackers Spread Malware via Fake Job Interviews

Futuristic Circuit Board. Blue with electrons.

<p>Cybersecurity researchers at Varonis have unveiled a new proof-of-concept (PoC) attack dubbed "Cookie-Bite," which leverages a malicious Chrome extension to extract session cookies from Azure Entra ID (formerly Azure Active Directory). This technique enables attackers to bypass multi-factor authentication (MFA) and maintain unauthorized access to Microsoft cloud services such as Microsoft 365, Outlook, and Teams.&nbsp;</p><figure id="figure-vwhscaiaorma4fq4hv"><img id="vwhscaiaorma4fq4hv" src="https://media.gettyimages.com/id/2186611997/photo/accept-cookies-button-on-a-web-page.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=_SpA7D1624t1IUQ2n0qcqn3g694XqIlpDZhYHrvMQCk=" alt="Accept cookies button on a web page" title="Accept cookies button on a web page" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2186611997/photo/accept-cookies-button-on-a-web-page.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=_SpA7D1624t1IUQ2n0qcqn3g694XqIlpDZhYHrvMQCk=" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>How the Cookie-Bite Attack Works</h3><p>The Cookie-Bite method centers on a malicious Chrome extension designed to target specific session cookies:&nbsp;</p><p><strong>ESTSAUTH</strong>: A transient session token indicating that the user has completed MFA. It remains valid for up to 24 hours or until the browser session ends.&nbsp;</p><p><strong>ESTSAUTHPERSISTENT</strong>: A persistent session token created when users opt to "Stay signed in" or when Azure applies the Keep Me Signed In (KMSI) policy. This token can remain valid for up to 90 days.&nbsp;</p><p>By extracting these cookies, attackers can impersonate authenticated users without needing to re-enter credentials or complete MFA challenges, effectively maintaining persistent access to the victim's cloud services.&nbsp;</p><h3>Implications and Risks</h3><p>While the concept of stealing session cookies is not new, the Cookie-Bite attack is notable for its stealth and persistence. Unlike traditional phishing attacks that rely on tricking users into revealing credentials, this method operates silently in the background, making detection more challenging.&nbsp;</p><p>The attack underscores the vulnerabilities associated with browser extensions, particularly those that are malicious or have been compromised. It also highlights the limitations of MFA when session tokens can be hijacked to bypass authentication mechanisms.&nbsp;</p><h3>Mitigation Strategies</h3><p>To protect against attacks like Cookie-Bite, organizations and users should consider the following measures: </p><ul><li><strong>Restrict Extension Installations: </strong>Limit the ability to install browser extensions to trusted sources and enforce policies that prevent the use of unauthorized extensions.</li><li><strong>Monitor for Suspicious Activity:</strong> Implement monitoring solutions to detect unusual behavior, such as unexpected access patterns or the use of unauthorized extensions.</li><li><strong>Regularly Review Session Policies:</strong> Evaluate and adjust session duration settings to minimize the window of opportunity for attackers to exploit stolen tokens.</li><li><strong>Educate Users:</strong> Provide training on the risks associated with browser extensions and encourage users to report any suspicious behavior.</li></ul><figure id="figure-u1yn04qbmma4fotxd"><img id="u1yn04qbmma4fotxd" src="https://media.gettyimages.com/id/1098076470/photo/search-engine.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=kqUg1kxOBfq7rJtEAZq-4YndTpvhRpwBbCdJSfL_Sbc=" alt="Search Engine" title="Search Engine" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1098076470/photo/search-engine.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=kqUg1kxOBfq7rJtEAZq-4YndTpvhRpwBbCdJSfL_Sbc=" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>Conclusion</h3><p>The Cookie-Bite attack highlights a critical gap in cloud security: even with multi-factor authentication in place, session tokens can still be hijacked to silently bypass protections. By exploiting browser extensions—often overlooked as a security risk—this PoC demonstrates how persistent access can be maintained without raising immediate alarms. It’s a clear reminder that security must extend beyond login credentials to include tighter control over session management, browser extensions, and user behavior monitoring. If your compnay is interested in learning more about what protections are available, visit our "Contact Us" page. Our vCISO service can help your company to bolster security posture and provide things like real-time network monitoring to protect from threats.<br>&nbsp;</p>

New 'Cookie-Bite' Attack Exploits Chrome Extension to Steal Azure Entra ID Session Tokens

<p>In today's digital landscape, attackers are no longer just stealing passwords—they're exploiting trusted authentication processes themselves. A recent campaign has highlighted how even familiar login workflows can be manipulated into dangerous backdoors, posing significant risks for small and mid-sized businesses (SMBs) that heavily rely on Microsoft 365.</p><h3>The Attack: Leveraging OAuth 2.0 for Unauthorized Access</h3><p><br>Researchers at Volexity have detailed how Russian-aligned threat groups are abusing OAuth 2.0 authentication flows to compromise Microsoft 365 accounts. While the campaign initially targeted organizations linked to Ukraine and human rights efforts, the tactics employed can easily be repurposed against SMBs across various industries.</p><p>The attack begins with a seemingly innocuous outreach. Victims are contacted through messaging apps like WhatsApp or Signal by individuals impersonating European officials or Ukrainian diplomats. The pretext is an invitation to a private video meeting. As the conversation progresses, the victim is sent a link—purportedly necessary to join the call—that prompts them to log into their Microsoft account.</p><p>Instead of stealing passwords outright, the attackers request an OAuth authorization code. This code, valid for up to 60 days, grants extensive access to the victim’s Microsoft 365 account—including email, files, and potentially sensitive business data—without ever needing their credentials.</p><h3>The Broader Implications for SMBs</h3><p><br>This method echoes adversary-in-the-middle (AiTM) attacks, where attackers steal session tokens to bypass authentication. However, in this case, the attackers are exploiting legitimate OAuth flows directly, making detection even more challenging.</p><p>In some instances, the attackers went further by registering a new device on the victim’s Microsoft Entra ID (formerly Azure Active Directory) after obtaining the code. To complete the compromise, they social-engineered the victim into approving a two-factor authentication (2FA) request, claiming it was necessary to join a SharePoint site tied to the fake conference.</p><p>The sophistication of this attack is alarming—it operates within the boundaries of trusted applications and processes, making it harder to detect and prevent. For SMBs, the implications are serious. Microsoft 365 often serves as the operational core for many companies, and a compromised account could lead to stolen data, financial fraud, reputational harm, and even regulatory issues. Moreover, many smaller organizations lack dedicated security teams to monitor every login or OAuth grant event, making these attacks even more insidious.</p><figure id="figure-ypshxt78dma25nysx"><img id="ypshxt78dma25nysx" src="https://media.gettyimages.com/id/515197135/photo/smartphone-risk-alert.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=CroUQHsky6UWII0rwCTolvSvNodVwPy4OUt8TMZ_XeI=" alt="Smartphone risk alert" title="Smartphone risk alert" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/515197135/photo/smartphone-risk-alert.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=CroUQHsky6UWII0rwCTolvSvNodVwPy4OUt8TMZ_XeI=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Understanding the Mechanics: OAuth 2.0 and Device Code Phishing</h3><p><br>OAuth 2.0 is widely adopted for delegated authorization, allowing users to grant third-party applications access to their data without sharing passwords. The protocol enables single sign-on (SSO), letting users access multiple services using their Microsoft 365 credentials.</p><p>Attackers exploit this by creating malicious applications that request excessive permissions. In device code phishing attacks, victims are tricked into visiting a legitimate Microsoft URL and entering a code provided by the attacker. Once entered, the attacker gains access tokens, allowing them to impersonate the user and access their data.</p><p>These tokens can be valid for extended periods, and unless explicitly revoked, they provide persistent access to the victim's account, even if the password is changed.</p><h3>Mitigation Strategies for SMBs</h3><p><br>Protecting against such sophisticated attacks requires a multi-faceted approach:</p><ul><li>Educate Employees: Regularly train staff to recognize phishing attempts, especially those involving unexpected authentication requests or unfamiliar applications.</li><li>Implement Conditional Access Policies: Use Microsoft's Conditional Access to restrict access based on user location, device compliance, and risk levels.</li><li>Monitor OAuth Activity: Regularly review and audit OAuth consents and connected applications within your Microsoft 365 environment.</li><li>Restrict User Consent: Configure settings to prevent users from consenting to applications without administrative approval.</li><li>Utilize Phishing-Resistant MFA: Adopt multi-factor authentication methods that are resistant to phishing, such as FIDO2 security keys.</li><li>Disable Unused Authentication Flows: If device code authentication is not required, consider disabling it to reduce the attack surface.</li><li>Regularly Review Access Logs: Monitor for unusual sign-in activities, such as logins from unfamiliar locations or devices.<br></li></ul><figure id="figure-xdm2g3mx29ma25ptiw"><img id="xdm2g3mx29ma25ptiw" src="https://media.gettyimages.com/id/1518920339/photo/list-of-banking-and-credit-card-application-notifications-on-a-smartphone.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=BJxS_BhLZw8Kd-n1jZ0BDVmLdZlYdWUc-TcNZJ-j8WY=" alt="List of banking and credit card application notifications on a smartphone" title="List of banking and credit card application notifications on a smartphone" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1518920339/photo/list-of-banking-and-credit-card-application-notifications-on-a-smartphone.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=BJxS_BhLZw8Kd-n1jZ0BDVmLdZlYdWUc-TcNZJ-j8WY=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Final Thoughts</h3><p><br>OAuth 2.0, while powerful and convenient, introduces new avenues for attackers to exploit. For SMBs, it's crucial to recognize that these sophisticated attacks are not limited to large enterprises. By understanding the risks and implementing robust security measures, SMBs can better protect their digital assets and maintain the trust of their clients and partners.</p><p>If you're uncertain about your organization's current security posture or need assistance in implementing these recommendations, consider consulting with TechHorizon Consulting who can provide tailored solutions to safeguard your business.</p>

Hackers Exploit OAuth 2.0 to Hijack Microsoft 365 Accounts — What SMBs Need to Know

Stealing personal data through a laptop concept

<h3>What Is Optical Character Recognition (OCR)?&nbsp;</h3><p>Optical Character Recognition (OCR) is a technology that converts images of text—such as scanned documents, photographs, or screenshots—into readable text. It's widely used in digitizing printed documents, automating data entry, and enabling text-to-speech for accessibility. OCR systems often leverage neural networks to achieve high accuracy in text recognition. &nbsp;</p><figure id="figure-1rjj3m20qem9ucszfw"><img id="1rjj3m20qem9ucszfw" src="https://media.gettyimages.com/id/2205662677/photo/cybersecurity-data-networks-and-modern-technology-security-background-digital-shield-icon.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Dp_PP38wsSMKXUOnxhoWRCPtzCU0ResbQfQuudVVm4I=" alt="Cybersecurity, data networks, and modern technology security background. Digital shield icon protection and safety concept." title="Cybersecurity, data networks, and modern technology security background. Digital shield icon protection and safety concept." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2205662677/photo/cybersecurity-data-networks-and-modern-technology-security-background-digital-shield-icon.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Dp_PP38wsSMKXUOnxhoWRCPtzCU0ResbQfQuudVVm4I=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Malicious Use of OCR by Threat Actors</h3><p>While OCR has many legitimate uses, cybercriminals have found ways to weaponize this technology. By integrating OCR into malware, attackers can extract sensitive information from images stored on victims' devices. This approach allows them to bypass traditional security measures that monitor text inputs or clipboard activity. Instead of only reading keyboard inputs or taking screenshots that might alert antivirus programs; these strains of malware can pull text straight from the screen without interacting with computer hardware.&nbsp;</p><h3>Notable Malware Utilizing OCR</h3><ul><li><strong>CherryBlos</strong>: Discovered in 2023, CherryBlos is an Android malware that uses OCR to extract cryptocurrency wallet recovery phrases from images stored on infected devices. It also overlays fake interfaces to steal credentials and hijacks clipboard data to redirect cryptocurrency transactions. &nbsp;</li><li><strong>SpyAgent</strong>: Identified by McAfee, SpyAgent scans devices for images containing crypto wallet recovery phrases. Using OCR, it extracts these phrases and sends them to attackers, granting them access to victims' cryptocurrency funds. SpyAgent has been detected in over 280 fraudulent apps, primarily targeting users in South Korea and the UK.&nbsp;</li><li><strong>SparkCat</strong>: This malware has been found in both Android and iOS apps, masquerading as legitimate services. SparkCat uses OCR to scan photo libraries for images containing wallet recovery phrases, which are then exfiltrated to command-and-control servers. Notably, SparkCat employs a Rust-based communication mechanism, a rarity in mobile malware.&nbsp;&nbsp;</li></ul><h3>Protecting Small and Medium-Sized Businesses (SMBs) from OCR-Based Attacks&nbsp;</h3><p>SMBs can take several measures to safeguard against OCR-based cyber threats:&nbsp;</p><ul><li>Employee Education: Train staff to avoid storing sensitive information, like passwords or recovery phrases, as images on their devices.</li><li>App Vetting: Implement strict policies for installing applications, ensuring they are from reputable sources and have been vetted for security. &nbsp;</li><li>Permission Management: Monitor and restrict app permissions, especially those requesting access to storage, camera, or accessibility features. &nbsp;</li><li>Regular Audits: Conduct periodic security audits to detect and remove unauthorized or malicious applications. &nbsp;</li><li>Use of Security Software: Deploy reputable mobile security solutions that can detect and prevent malware infections. &nbsp;</li><li>Data Encryption: Encourage the use of encrypted storage solutions for sensitive information, reducing the risk of data being compromised if accessed.&nbsp;&nbsp;</li></ul><figure id="figure-gsrb9h7mgum9ucv5b1" class=""><img id="gsrb9h7mgum9ucv5b1" src="https://media.gettyimages.com/id/2178829522/photo/technological-field.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=jdbjGShmQgmVELUjPINEuuwASQ-9n7Mg7iS0G-yY_rE=" alt="Technological Field." title="Technological Field." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2178829522/photo/technological-field.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=jdbjGShmQgmVELUjPINEuuwASQ-9n7Mg7iS0G-yY_rE=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Conclusion&nbsp;</h3><p>OCR technology, while beneficial in many contexts, has been exploited by cybercriminals to extract sensitive information from images. Malware like CherryBlos, SpyAgent, and SparkCat demonstrate the evolving tactics of threat actors in targeting unsuspecting users. SMBs must remain vigilant, educating employees and implementing robust security measures to protect against these sophisticated attacks. Protecting from these attacks requires resources for training employees and continuous network monitoring. These services can require companies to hire a CISO, an expensive endeavor, TechHorizon Consulting can help with our vCISO service. We provide services like the ones mentioned for a fraction of the cost of a tradition CISO, if this interests you or your company please visit our "Contact Us" page.&nbsp;<br>&nbsp;</p>

How Threat Actors Exploit Optical Character Recognition in Cybersecurity Attacks

Encryption your data. Binary code and digital Lock. Hacker attack and data breach. Big data with encrypted computer code. Safe your data. Cyber internet security and privacy concept. Database storage 3d illustration

<p>Browser extensions have become deeply embedded in modern workflows—whether it’s spell checkers, ad blockers, or GenAI-powered productivity tools. While they offer convenience and enhanced user experience, a new report highlights how they also represent one of the most overlooked and underestimated attack surfaces in today’s enterprise landscape.</p><p>LayerX recently released the Enterprise Browser Extension Security Report 2025, the first report to combine marketplace data with real-world enterprise usage telemetry. The findings shine a light on the widespread use of browser extensions and the significant security implications they carry.</p><h3>Browser Extensions Are Everywhere—And Risky</h3><p>Below is a compiled list of findings reported by LayerX&nbsp;&nbsp;</p><p><br><strong>Browser extensions are nearly universal.</strong><br>According to the report, 99% of employees have browser extensions installed, and over half (52%) have more than ten running at any given time. These tools have become indispensable, but their risks are largely invisible to security teams.</p><p><strong>More than half of extensions access sensitive data.</strong><br>An alarming 53% of extensions have permissions to access sensitive information such as cookies, passwords, browsing history, and the contents of web pages. This means a single compromised extension can create an entry point into critical enterprise data.</p><p><strong>Extension publishers are often untraceable.</strong><br>The majority of these extensions are published by unknown developers—54% are associated only with generic Gmail addresses. Additionally, 79% of publishers have released just a single extension, making it extremely difficult to evaluate their trustworthiness or maintain accountability.</p><figure id="figure-va5a3gji6m9ryrxgu"><img id="va5a3gji6m9ryrxgu" src="https://media.gettyimages.com/id/1159680962/photo/word-risk.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=SjKfumYGBysI4gsLvD5SRr8X9cGq40VJ3I6lunpVKjM=" alt="Word Risk" title="Word Risk" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1159680962/photo/word-risk.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=SjKfumYGBysI4gsLvD5SRr8X9cGq40VJ3I6lunpVKjM=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>GenAI Extensions: A Growing Threat Vector</h3><p>GenAI tools in the browser have exploded in popularity—over 20% of users now have at least one installed. But often, these extensions routinely demand high‑risk permissions, often accessing data that businesses would never voluntarily share with third parties. Before rolling out any GenAI helper to your teams, establish clear policies on what data can be used, where it’s stored, and how it’s protected.</p><h3>Outdated and Sideloaded Extensions Multiply the Risk</h3><p><br>Outdated software is often vulnerable software, and browser extensions are no exception. The report finds that 51% of extensions haven’t received updates in over a year. On top of that, 26% of enterprise extensions are sideloaded—bypassing even the basic vetting provided by official extension marketplaces.</p><p>These extensions may not be malicious by design, but their lack of maintenance or scrutiny makes them prime targets for exploitation.</p><h3>Five Recommendations for Security Teams</h3><p><br></p><p>LayerX doesn’t just highlight the problem—it offers a roadmap for security and IT teams ready to tackle this risk head‑on:</p><ol><li>Audit all browser extensions:<ul data-mce-style="list-style-type: circle;" style="list-style-type: circle;"><li>Visibility is the first step. Create a comprehensive inventory of all extensions installed across the organization.</li></ul></li><li>Categorize extensions by function and user base:<ul data-mce-style="list-style-type: circle;" style="list-style-type: circle;"><li>Some extensions pose more risk than others due to their wide usage or elevated permissions. Prioritize high-impact categories like GenAI and productivity tools.</li></ul></li><li>Enumerate extension permissions:<ul data-mce-style="list-style-type: circle;" style="list-style-type: circle;"><li>Document what each extension can access. This helps define your exposure and prioritize remediation.</li></ul></li><li>Assess and score risk:<ul data-mce-style="list-style-type: circle;" style="list-style-type: circle;"><li>Evaluate each extension based on its permissions, reputation, developer information, popularity, and installation method. Consolidate this into a unified risk score.</li></ul></li><li>Use adaptive, risk-based enforcement:<ul data-mce-style="list-style-type: circle;" style="list-style-type: circle;"><li>Use the risk scores to enforce policies that balance productivity and security—blocking high-risk extensions while allowing those that are safe and necessary.</li></ul></li></ol><figure id="figure-sushw8cbrem9ryu6cw"><img id="sushw8cbrem9ryu6cw" src="https://media.gettyimages.com/id/992095120/photo/computer-security-concept.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8kdeNznaPOuNYVIOvMOKbojY0iospO31j13zDJYQQ2E=" alt="COMPUTER SECURITY CONCEPT" title="COMPUTER SECURITY CONCEPT" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/992095120/photo/computer-security-concept.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8kdeNznaPOuNYVIOvMOKbojY0iospO31j13zDJYQQ2E=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Final Thoughts</h3><p><br></p><p>Browser extensions are more than just productivity boosters—they’re a growing part of your enterprise attack surface. LayerX’s 2025 report is clear, it’s time to treat browser extensions with the same scrutiny as any other software in your network.</p><p>By combining visibility, policy, and adaptive enforcement, you can let your teams enjoy the benefits of browser extensions without sacrificing security. With the right approach, you’ll turn these potential liabilities into managed assets—and keep your data, and your business, safe.<br></p><p><br></p>

Articles

Darcula: The AI-Powered Phishing Platform Fueling a Globa...

North Korean Hackers Spread Malware via Fake Job Interviews

New 'Cookie-Bite' Attack Exploits Chrome Extension to Ste...

Hackers Exploit OAuth 2.0 to Hijack Microsoft 365 Account...

How Threat Actors Exploit Optical Character Recognition i...

Browser Extensions: The Quiet Security Risk Lurking in En...