Blog

Businessman secures data with encryption and network security, protecting transactions. Cybersecurity for online business, data privacy, and defense against cyber attacks.

<h3>AI Hype Exploited for Malware Distribution</h3><p>Cybercriminals are leveraging the popularity of artificial intelligence to distribute a new information-stealing malware known as Noodlophile. This campaign stands out for its use of polished, AI-themed websites and social media pages that appear legitimate, but are in fact fronts for malicious activity.</p><p>Promoted through Facebook groups with names like “Luma Dreammachine AI” and “gratistuslibros,” these platforms lure users with promises of advanced image, video, and logo creation tools. Posts from these pages have reached over 62,000 views, highlighting the scale and success of the operation.</p><h3>&nbsp;<br>From Social Media to System Compromise</h3><p>The attack begins when users interact with these fraudulent AI websites and upload prompts for supposed content generation. In return, they are prompted to download what appears to be the finished product—delivered as a ZIP archive.</p><p>The ZIP contains a deceptive file that, when executed, launches a legitimate CapCut binary to reduce suspicion. Behind the scenes, a .NET-based loader installs a Python-based payload that downloads and runs the Noodlophile Stealer.</p><p>This method of combining legitimate software with malicious loaders allows the attackers to maintain a low profile while executing their infection chain.</p><figure id="figure-i00gkhggqdmamm1y3m" class=""><img id="i00gkhggqdmamm1y3m" src="https://media.gettyimages.com/id/1498460653/photo/business-man-using-digital-chatbot-artificial-intelligence-with-hacking-and-warning-alert.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=SFEMfpv_gKhwIVwmIDkjK1vphbpJb9shsmTltmqKu1w=" alt="Business man using digital chatbot Artificial Intelligence (AI) with hacking and warning alert. cyber attack network, spyware or Malicious software. Technology cyber security and cybercrime." title="Business man using digital chatbot Artificial Intelligence (AI) with hacking and warning alert. cyber attack network, spyware or Malicious software. Technology cyber security and cybercrime." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1498460653/photo/business-man-using-digital-chatbot-artificial-intelligence-with-hacking-and-warning-alert.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=SFEMfpv_gKhwIVwmIDkjK1vphbpJb9shsmTltmqKu1w=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>&nbsp;<br>Capabilities of Noodlophile Stealer</h3><p>Once installed, Noodlophile is designed to extract a wide range of sensitive information. This includes saved browser credentials, cryptocurrency wallet details, and potentially other confidential user data. In certain variants, the malware also deploys XWorm, a remote access trojan (RAT) that allows attackers to maintain persistent access to the compromised system.</p><p>The malware developer, believed to be based in Vietnam, has openly described themselves as a “passionate malware developer” on GitHub—an example of how some threat actors are now operating in the open.</p><h3>&nbsp;<br>Implications for Credit Unions</h3><p>This threat is especially relevant for smaller credit unions, where employees may explore free or trending AI tools to enhance marketing, communications, or member engagement. Platforms like Facebook, commonly used by credit unions for community outreach, are also where these malicious tools are being advertised.</p><p>A single compromised device—especially one tied to business operations—can lead to credential theft, unauthorized access to sensitive systems, and ultimately financial or reputational damage.</p><h3>&nbsp;<br>Emerging Trend: AI-Themed Malware Campaigns</h3><p>This is part of a broader pattern. In 2023, Meta reported that it had taken down more than 1,000 malicious links exploiting interest in AI, particularly ChatGPT, to distribute malware. The Noodlophile campaign follows a similar model but with enhanced social engineering tactics and a focus on multimedia content creation.</p><p>The use of legitimate-looking branding and downloadable binaries disguised as familiar tools shows how threat actors are adapting their strategies to align with trending technologies.</p><figure id="figure-b757wd3g0pmamm3bvz" class=""><img id="b757wd3g0pmamm3bvz" src="https://media.gettyimages.com/id/2168048376/photo/cybersecurity-warning-alert-system-concept-businessman-working-on-laptop-computer-network.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=3vsEQsFv7OXMasFddrhqmwuWk0qfY3L4qVxRwvYbGNY=" alt="Cybersecurity warning alert system concept. Businessman working on laptop. Computer network hack, crime and virus, Malicious software, compromised information, illegal connection, data vulnerability," title="Cybersecurity warning alert system concept. Businessman working on laptop. Computer network hack, crime and virus, Malicious software, compromised information, illegal connection, data vulnerability," class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2168048376/photo/cybersecurity-warning-alert-system-concept-businessman-working-on-laptop-computer-network.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=3vsEQsFv7OXMasFddrhqmwuWk0qfY3L4qVxRwvYbGNY=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>&nbsp;<br>Risk Mitigation Considerations</h3><p>To reduce exposure to these types of threats, credit unions need to reinforce internal awareness around the risks of downloading unverified AI tools—especially those found via social media. Limiting employee ability to install unauthorized software, deploying modern endpoint protection, and routinely monitoring systems for suspicious behavior are all advisable measures.</p><p>Even without advanced persistence or obfuscation techniques, simple but effective malware like Noodlophile can cause significant harm if not caught early</p><h3>&nbsp;<br>AI as a Double-Edged Sword</h3><p>As artificial intelligence continues to shape the tools we use daily, it’s also becoming a powerful weapon for cybercriminals. The same curiosity that drives employees to explore new platforms can become a point of compromise if precautions aren't taken.&nbsp; If you feel your company needs assistence in compating the rising AI threat, TechHorizon Consulting has the experance to assist you with staying protected in todays everchanging cyber landscape.</p>

New Malware Campaign Targets Users with Fake AI Video Editing Tools

HUD Padlock Icon Cyber Security, Digital Data Network Protection, Future Technology Digital Data Network Connection Background Concept. 3d rendering

<p><br>Phishing-as-a-Service (PhaaS) platforms have emerged as a significant concern in the cyber secutiy space. Among them, Darcula stands out as a particularly dangerous entity, leveraging advanced technologies to democratize cybercrime and escalate phishing attacks worldwide.</p><figure id="figure-of5scf8asqmaeeiqfl"><img id="of5scf8asqmaeeiqfl" src="https://media.gettyimages.com/id/2151633407/photo/threat-phishing-malicious-danger-hack-warning-mail-thief-scam-alert-safety-letter-technology.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8qOEdVVtrcoBXOj76y6b8ujfyEYhUHdpxhf1SeViRQw=" alt="Threat, phishing, malicious, danger, hack, warning, mail, thief, scam, alert, safety, letter, technology, online, Cyber crime security concept, Alert Email inbox and spam virus with warning caution." title="Threat, phishing, malicious, danger, hack, warning, mail, thief, scam, alert, safety, letter, technology, online, Cyber crime security concept, Alert Email inbox and spam virus with warning caution." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2151633407/photo/threat-phishing-malicious-danger-hack-warning-mail-thief-scam-alert-safety-letter-technology.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8qOEdVVtrcoBXOj76y6b8ujfyEYhUHdpxhf1SeViRQw=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>What is Darcula?</h3><p>Darcula is a Chinese-language PhaaS platform that has revolutionized phishing. It offers an all-in-one suite to launch sophisticated phishing campaigns with minimal effort. Subscribers gain access to over 200 customizable templates impersonating global brands, including postal services, financial institutions, and government agencies. The platform's user-friendly interface allows even non-technical individuals to deploy phishing sites rapidly.</p><h3>Why Darcula is Particularly Dangerous</h3><ul><li><strong>Ease of Use: </strong>Darcula's simple design lowers the barrier to entry for cybercriminals. Users can simply input the URL of a legitimate website, and the platform clones it, enabling the insertion of malicious content without any coding knowledge. This automation allows individuals with minimal technical skills to execute complex phishing attacks.</li><li><strong>Scalability: </strong>The platform supports mass deployment of phishing campaigns across various channels, including SMS, iMessage, and Rich Communication Services (RCS). By utilizing these messaging services, Darcula can bypass traditional SMS firewalls, increasing the reach and effectiveness of its campaigns.</li><li><strong>Advanced Technology Integration: </strong>Darcula employs modern technologies such as JavaScript, React, Docker, and Harbor, mirroring the infrastructure of legitimate SaaS companies. This sophisticated setup enhances the platform's reliability and scalability, making it a powerful tool in the hands of cybercriminals.</li><li><strong>Generative AI Capabilities: </strong>Recently Darcula has integrated generative AI into its toolkit. This feature allows for the automatic creation of phishing pages in multiple languages, complete with customizable forms and localized translations. The AI-assisted functionality enables rapid deployment of tailored phishing sites, further lowering the technical threshold for attackers.</li></ul><h3>Real-World Impact</h3><p>Darcula's operations have had a profound global impact. Between 2023 and 2024, the platform was responsible for stealing 884,000 credit card numbers through phishing texts, resulting from 13 million clicks on malicious links. Its reach spans over 100 countries, with phishing domains impersonating various services. The platform's ability to target both Android and iPhone users via SMS, iMessage, and RCS has made it a critical threat.</p><h3>Implications for Businesses and Users</h3><p>The rise of platforms like Darcula signifies a shift in the cyber threat landscape, where sophisticated phishing tools are readily accessible to a broader range of attackers. Businesses must recognize the heightened risk and adapt their security measures accordingly. Traditional defenses may no longer suffice against such advanced threats.</p><h3>How to Defend Against Darcula-Based Phishing</h3><p><strong>Technical Measures:</strong></p><ul><li><strong>Advanced Filtering:</strong> Implement real-time threat intelligence and advanced email/SMS filtering systems to detect and block phishing attempts.</li><li><strong>Multi-Factor Authentication (MFA):</strong> Enforce MFA across all user accounts to add an extra layer of security.</li></ul><p><strong>Behavioral Strategies:</strong></p><ul><li><strong>User Education:</strong> Conduct regular training sessions to help users identify phishing attempts, such as unexpected messages or unfamiliar links.</li><li><strong>Reporting Mechanisms:</strong> Establish clear protocols for reporting suspicious communications to enable swift action.<br data-mce-bogus="1"></li></ul><figure id="figure-mra24pues6maeejfgj"><img id="mra24pues6maeejfgj" src="https://media.gettyimages.com/id/1322517295/photo/cyber-security-it-engineer-working-on-protecting-network-against-cyberattack-from-hackers-on.jpg?b=1&s=2048x2048&w=0&k=20&c=KYzhQhnqvXMZtH6W_hI7fF0vHzWshl5_m-1X31NgDTw=" alt="Cyber security IT engineer working on protecting network against cyberattack from hackers on internet. Secure access for online privacy and personal data protection. Hands typing on keyboard and PCB" title="Cyber security IT engineer working on protecting network against cyberattack from hackers on internet. Secure access for online privacy and personal data protection. Hands typing on keyboard and PCB" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h3>Conclusion</h3><p>Darcula exemplifies the growing trend of cybercrime-as-a-service, where advanced tools are made accessible to a wider audience. The integration of AI into phishing platforms marks a significant escalation in the threat landscape. It is imperative for organizations and individuals to stay informed, adopt robust security measures, and foster a culture of vigilance to counteract these evolving threats. If your company has concerns about phising threats, visit our "Contact Us" page. With our vCISO service we can provide you with email phising monitoring services as well as real-time networking montoring to both prevent and respond to breaches.&nbsp;</p>

Darcula: The AI-Powered Phishing Platform Fueling a Global Cybercrime Surge

Cyber threat from North Korea. North Korean hacker at the computer, on a background of binary code, the colors of the flag of the DPRK. DDoS attack

<p>North Korean state-backed hackers are once again turning job seekers into unwitting victims. In a new campaign tracked as Contagious Interview, attacks pose as recruiters from fake crypto consulting firms to lure candidates into malware traps. Unlike previous efforts focused on phishing or exploiting crypto tools directly, this one weaponizes the hiring process itself.</p><h2>Fake Interviews, Real Malware</h2><p><br>Researchers at Silent Push have identified a set of front companies—BlockNovas LLC, Angeloper Agency, and SoftGlide LLC—being used by threat actors to distribute malware through fake job interviews. These aren’t just spoofed profiles or short-lived websites. The companies have full online personas, complete with fabricated employee profiles, websites claiming years of experience, and active presences on LinkedIn, GitHub, and even Medium.</p><p>Candidates are tricked during the hiring process, often being asked to complete coding tasks or “fix browser issues” related to their video assessments. In reality, these tasks are a cover for delivering cross-platform malware. Three distinct malware families—BeaverTail, InvisibleFerret, and OtterCookie—have been identified as part of the campaign. These can exfiltrate credentials, take screenshots, and provide long-term backdoor access.</p><figure id="figure-ems1nt52shmac01rs1"><img id="ems1nt52shmac01rs1" src="https://media.gettyimages.com/id/1307598870/photo/male-indian-hr-recruiter-or-employer-holding-cv-having-online-virtual-job-interview-meeting.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=KaiE_KHDHqfWSc_Zj3PI_fxVzExQFawu3jreCysaaHg=" alt="Male indian hr, recruiter or employer holding cv having online virtual job interview meeting with african candidate on video call. Distance remote recruitment conference chat. Over shoulder view." title="Male indian hr, recruiter or employer holding cv having online virtual job interview meeting with african candidate on video call. Distance remote recruitment conference chat. Over shoulder view." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1307598870/photo/male-indian-hr-recruiter-or-employer-holding-cv-having-online-virtual-job-interview-meeting.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=KaiE_KHDHqfWSc_Zj3PI_fxVzExQFawu3jreCysaaHg=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Why Is North Korea Doing This?</h2><p><br>This operation is more than a cybercrime scheme—it’s a state-funded campaign designed to serve two strategic goals: raise money for the regime and steal intellectual property.</p><p>The Democratic People's Republic of Korea (DPRK) is under heavy international sanctions and relies heavily on illicit cyber operations to fund its government. Cybersecurity experts have consistently tracked activity that blends financial theft with espionage, and campaigns like Contagious Interview fit squarely within that pattern.</p><p>In addition to deploying malware, North Korea has used these fake hiring efforts to gather intelligence on companies and their technologies, particularly in the blockchain and fintech sectors. In some cases, they’ve even gotten job applicants to run malware that compromised cryptocurrency wallets like MetaMask.</p><h2>Ties to a Broader Social Engineering Network</h2><p><br>Contagious Interview is one part of a wider ecosystem of North Korean social engineering operations. Another campaign known as Wagemole involves crafting AI-generated personas to gain legitimate employment in Western tech firms. These fake workers often pass interviews using highly coordinated playbooks and tools, then quietly work remote jobs while sending portions of their salaries back to Pyongyang.</p><p>GenAI-powered services are now being used to streamline every part of this process. From scheduling interviews to transcribing calls and translating real-time conversations, the operation is becoming more automated and scalable. Researchers note that a small group of facilitators often control multiple fake identities, juggling several job applications at once.</p><p><br></p><figure id="figure-t8obhcgskmac065l6"><img id="t8obhcgskmac065l6" src="https://media.gettyimages.com/id/1502418564/photo/black-hat-hacker-in-hood-using-laptop-computer-and-call-smartphone-to-victim-on-desk-hacking.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=qw-g96lux6Dw6_w7l74aNoLyPSASdLvWWiPni7NIMno=" alt="Black hat hacker in hood using laptop computer and call smartphone to victim on desk hacking privacy sensitive data hack in dark room background. Cyber security cyber crime concept. Hacking phishing" title="Black hat hacker in hood using laptop computer and call smartphone to victim on desk hacking privacy sensitive data hack in dark room background. Cyber security cyber crime concept. Hacking phishing" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1502418564/photo/black-hat-hacker-in-hood-using-laptop-computer-and-call-smartphone-to-victim-on-desk-hacking.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=qw-g96lux6Dw6_w7l74aNoLyPSASdLvWWiPni7NIMno=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h2>Infrastructure and Obfuscation</h2><p><br>Much of the technical infrastructure for this campaign is intentionally anonymized. The attackers use VPN services like Astrill, residential proxies, and even password-cracking tools like Hashtopolis hosted on their fake domains. One subdomain tied to BlockNovas was found running a status dashboard monitoring their broader infrastructure, including sites like lianxinxiao.com and angeloperonline.online.</p><p>These connections were traced to IP ranges in Russia, particularly in the Khasan and Khabarovsk regions—areas known for proximity and ties to North Korea. While it’s not confirmed whether the Russian infrastructure providers are cooperating directly, it suggests some level of facilitation or indirect support.</p><h2>Mitigating the Threat</h2><p><br>There is no single fix for this threat, but awareness is a strong starting point. Hiring managers, HR teams, and technical leads must be trained to spot red flags in the recruitment process. Be cautious when asked to download unfamiliar tools during interviews or when interacting with companies that have little verifiable history.</p><p>Organizations should also implement stronger endpoint protections. Staff—especially developers—should not have unrestricted ability to install software, particularly during onboarding or interviews. Activity monitoring, restricted permissions, and application allowlisting are effective safeguards.</p><p>Finally, verify the legitimacy of vendors and applicants alike. Use open-source intelligence tools to check domain histories, employee photos, and company claims. If a firm says it’s been around for 12 years but was registered 6 months ago, that’s a serious red flag.</p><h2>The Bottom Line</h2><p><br>The fake interview lure represents a chilling evolution in North Korean cyber tactics. By turning the hiring process into an attack vector, these threat actors are able to bypass traditional security tools and get closer to valuable targets.</p><p>It’s a reminder that in today’s cyber threat landscape, even a job interview can be a front for state-sponsored malware. Vigilance, verification, and education are your first lines of defense.</p>

North Korean Hackers Spread Malware via Fake Job Interviews

Futuristic Circuit Board. Blue with electrons.

<p>Cybersecurity researchers at Varonis have unveiled a new proof-of-concept (PoC) attack dubbed "Cookie-Bite," which leverages a malicious Chrome extension to extract session cookies from Azure Entra ID (formerly Azure Active Directory). This technique enables attackers to bypass multi-factor authentication (MFA) and maintain unauthorized access to Microsoft cloud services such as Microsoft 365, Outlook, and Teams.&nbsp;</p><figure id="figure-vwhscaiaorma4fq4hv"><img id="vwhscaiaorma4fq4hv" src="https://media.gettyimages.com/id/2186611997/photo/accept-cookies-button-on-a-web-page.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=_SpA7D1624t1IUQ2n0qcqn3g694XqIlpDZhYHrvMQCk=" alt="Accept cookies button on a web page" title="Accept cookies button on a web page" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2186611997/photo/accept-cookies-button-on-a-web-page.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=_SpA7D1624t1IUQ2n0qcqn3g694XqIlpDZhYHrvMQCk=" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>How the Cookie-Bite Attack Works</h3><p>The Cookie-Bite method centers on a malicious Chrome extension designed to target specific session cookies:&nbsp;</p><p><strong>ESTSAUTH</strong>: A transient session token indicating that the user has completed MFA. It remains valid for up to 24 hours or until the browser session ends.&nbsp;</p><p><strong>ESTSAUTHPERSISTENT</strong>: A persistent session token created when users opt to "Stay signed in" or when Azure applies the Keep Me Signed In (KMSI) policy. This token can remain valid for up to 90 days.&nbsp;</p><p>By extracting these cookies, attackers can impersonate authenticated users without needing to re-enter credentials or complete MFA challenges, effectively maintaining persistent access to the victim's cloud services.&nbsp;</p><h3>Implications and Risks</h3><p>While the concept of stealing session cookies is not new, the Cookie-Bite attack is notable for its stealth and persistence. Unlike traditional phishing attacks that rely on tricking users into revealing credentials, this method operates silently in the background, making detection more challenging.&nbsp;</p><p>The attack underscores the vulnerabilities associated with browser extensions, particularly those that are malicious or have been compromised. It also highlights the limitations of MFA when session tokens can be hijacked to bypass authentication mechanisms.&nbsp;</p><h3>Mitigation Strategies</h3><p>To protect against attacks like Cookie-Bite, organizations and users should consider the following measures: </p><ul><li><strong>Restrict Extension Installations: </strong>Limit the ability to install browser extensions to trusted sources and enforce policies that prevent the use of unauthorized extensions.</li><li><strong>Monitor for Suspicious Activity:</strong> Implement monitoring solutions to detect unusual behavior, such as unexpected access patterns or the use of unauthorized extensions.</li><li><strong>Regularly Review Session Policies:</strong> Evaluate and adjust session duration settings to minimize the window of opportunity for attackers to exploit stolen tokens.</li><li><strong>Educate Users:</strong> Provide training on the risks associated with browser extensions and encourage users to report any suspicious behavior.</li></ul><figure id="figure-u1yn04qbmma4fotxd"><img id="u1yn04qbmma4fotxd" src="https://media.gettyimages.com/id/1098076470/photo/search-engine.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=kqUg1kxOBfq7rJtEAZq-4YndTpvhRpwBbCdJSfL_Sbc=" alt="Search Engine" title="Search Engine" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1098076470/photo/search-engine.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=kqUg1kxOBfq7rJtEAZq-4YndTpvhRpwBbCdJSfL_Sbc=" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>Conclusion</h3><p>The Cookie-Bite attack highlights a critical gap in cloud security: even with multi-factor authentication in place, session tokens can still be hijacked to silently bypass protections. By exploiting browser extensions—often overlooked as a security risk—this PoC demonstrates how persistent access can be maintained without raising immediate alarms. It’s a clear reminder that security must extend beyond login credentials to include tighter control over session management, browser extensions, and user behavior monitoring. If your compnay is interested in learning more about what protections are available, visit our "Contact Us" page. Our vCISO service can help your company to bolster security posture and provide things like real-time network monitoring to protect from threats.<br>&nbsp;</p>

New 'Cookie-Bite' Attack Exploits Chrome Extension to Steal Azure Entra ID Session Tokens

<p>In today's digital landscape, attackers are no longer just stealing passwords—they're exploiting trusted authentication processes themselves. A recent campaign has highlighted how even familiar login workflows can be manipulated into dangerous backdoors, posing significant risks for small and mid-sized businesses (SMBs) that heavily rely on Microsoft 365.</p><h3>The Attack: Leveraging OAuth 2.0 for Unauthorized Access</h3><p><br>Researchers at Volexity have detailed how Russian-aligned threat groups are abusing OAuth 2.0 authentication flows to compromise Microsoft 365 accounts. While the campaign initially targeted organizations linked to Ukraine and human rights efforts, the tactics employed can easily be repurposed against SMBs across various industries.</p><p>The attack begins with a seemingly innocuous outreach. Victims are contacted through messaging apps like WhatsApp or Signal by individuals impersonating European officials or Ukrainian diplomats. The pretext is an invitation to a private video meeting. As the conversation progresses, the victim is sent a link—purportedly necessary to join the call—that prompts them to log into their Microsoft account.</p><p>Instead of stealing passwords outright, the attackers request an OAuth authorization code. This code, valid for up to 60 days, grants extensive access to the victim’s Microsoft 365 account—including email, files, and potentially sensitive business data—without ever needing their credentials.</p><h3>The Broader Implications for SMBs</h3><p><br>This method echoes adversary-in-the-middle (AiTM) attacks, where attackers steal session tokens to bypass authentication. However, in this case, the attackers are exploiting legitimate OAuth flows directly, making detection even more challenging.</p><p>In some instances, the attackers went further by registering a new device on the victim’s Microsoft Entra ID (formerly Azure Active Directory) after obtaining the code. To complete the compromise, they social-engineered the victim into approving a two-factor authentication (2FA) request, claiming it was necessary to join a SharePoint site tied to the fake conference.</p><p>The sophistication of this attack is alarming—it operates within the boundaries of trusted applications and processes, making it harder to detect and prevent. For SMBs, the implications are serious. Microsoft 365 often serves as the operational core for many companies, and a compromised account could lead to stolen data, financial fraud, reputational harm, and even regulatory issues. Moreover, many smaller organizations lack dedicated security teams to monitor every login or OAuth grant event, making these attacks even more insidious.</p><figure id="figure-ypshxt78dma25nysx"><img id="ypshxt78dma25nysx" src="https://media.gettyimages.com/id/515197135/photo/smartphone-risk-alert.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=CroUQHsky6UWII0rwCTolvSvNodVwPy4OUt8TMZ_XeI=" alt="Smartphone risk alert" title="Smartphone risk alert" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/515197135/photo/smartphone-risk-alert.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=CroUQHsky6UWII0rwCTolvSvNodVwPy4OUt8TMZ_XeI=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Understanding the Mechanics: OAuth 2.0 and Device Code Phishing</h3><p><br>OAuth 2.0 is widely adopted for delegated authorization, allowing users to grant third-party applications access to their data without sharing passwords. The protocol enables single sign-on (SSO), letting users access multiple services using their Microsoft 365 credentials.</p><p>Attackers exploit this by creating malicious applications that request excessive permissions. In device code phishing attacks, victims are tricked into visiting a legitimate Microsoft URL and entering a code provided by the attacker. Once entered, the attacker gains access tokens, allowing them to impersonate the user and access their data.</p><p>These tokens can be valid for extended periods, and unless explicitly revoked, they provide persistent access to the victim's account, even if the password is changed.</p><h3>Mitigation Strategies for SMBs</h3><p><br>Protecting against such sophisticated attacks requires a multi-faceted approach:</p><ul><li>Educate Employees: Regularly train staff to recognize phishing attempts, especially those involving unexpected authentication requests or unfamiliar applications.</li><li>Implement Conditional Access Policies: Use Microsoft's Conditional Access to restrict access based on user location, device compliance, and risk levels.</li><li>Monitor OAuth Activity: Regularly review and audit OAuth consents and connected applications within your Microsoft 365 environment.</li><li>Restrict User Consent: Configure settings to prevent users from consenting to applications without administrative approval.</li><li>Utilize Phishing-Resistant MFA: Adopt multi-factor authentication methods that are resistant to phishing, such as FIDO2 security keys.</li><li>Disable Unused Authentication Flows: If device code authentication is not required, consider disabling it to reduce the attack surface.</li><li>Regularly Review Access Logs: Monitor for unusual sign-in activities, such as logins from unfamiliar locations or devices.<br></li></ul><figure id="figure-xdm2g3mx29ma25ptiw"><img id="xdm2g3mx29ma25ptiw" src="https://media.gettyimages.com/id/1518920339/photo/list-of-banking-and-credit-card-application-notifications-on-a-smartphone.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=BJxS_BhLZw8Kd-n1jZ0BDVmLdZlYdWUc-TcNZJ-j8WY=" alt="List of banking and credit card application notifications on a smartphone" title="List of banking and credit card application notifications on a smartphone" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1518920339/photo/list-of-banking-and-credit-card-application-notifications-on-a-smartphone.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=BJxS_BhLZw8Kd-n1jZ0BDVmLdZlYdWUc-TcNZJ-j8WY=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Final Thoughts</h3><p><br>OAuth 2.0, while powerful and convenient, introduces new avenues for attackers to exploit. For SMBs, it's crucial to recognize that these sophisticated attacks are not limited to large enterprises. By understanding the risks and implementing robust security measures, SMBs can better protect their digital assets and maintain the trust of their clients and partners.</p><p>If you're uncertain about your organization's current security posture or need assistance in implementing these recommendations, consider consulting with TechHorizon Consulting who can provide tailored solutions to safeguard your business.</p>

Hackers Exploit OAuth 2.0 to Hijack Microsoft 365 Accounts — What SMBs Need to Know

Stealing personal data through a laptop concept

<h3>What Is Optical Character Recognition (OCR)?&nbsp;</h3><p>Optical Character Recognition (OCR) is a technology that converts images of text—such as scanned documents, photographs, or screenshots—into readable text. It's widely used in digitizing printed documents, automating data entry, and enabling text-to-speech for accessibility. OCR systems often leverage neural networks to achieve high accuracy in text recognition. &nbsp;</p><figure id="figure-1rjj3m20qem9ucszfw"><img id="1rjj3m20qem9ucszfw" src="https://media.gettyimages.com/id/2205662677/photo/cybersecurity-data-networks-and-modern-technology-security-background-digital-shield-icon.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Dp_PP38wsSMKXUOnxhoWRCPtzCU0ResbQfQuudVVm4I=" alt="Cybersecurity, data networks, and modern technology security background. Digital shield icon protection and safety concept." title="Cybersecurity, data networks, and modern technology security background. Digital shield icon protection and safety concept." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2205662677/photo/cybersecurity-data-networks-and-modern-technology-security-background-digital-shield-icon.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Dp_PP38wsSMKXUOnxhoWRCPtzCU0ResbQfQuudVVm4I=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Malicious Use of OCR by Threat Actors</h3><p>While OCR has many legitimate uses, cybercriminals have found ways to weaponize this technology. By integrating OCR into malware, attackers can extract sensitive information from images stored on victims' devices. This approach allows them to bypass traditional security measures that monitor text inputs or clipboard activity. Instead of only reading keyboard inputs or taking screenshots that might alert antivirus programs; these strains of malware can pull text straight from the screen without interacting with computer hardware.&nbsp;</p><h3>Notable Malware Utilizing OCR</h3><ul><li><strong>CherryBlos</strong>: Discovered in 2023, CherryBlos is an Android malware that uses OCR to extract cryptocurrency wallet recovery phrases from images stored on infected devices. It also overlays fake interfaces to steal credentials and hijacks clipboard data to redirect cryptocurrency transactions. &nbsp;</li><li><strong>SpyAgent</strong>: Identified by McAfee, SpyAgent scans devices for images containing crypto wallet recovery phrases. Using OCR, it extracts these phrases and sends them to attackers, granting them access to victims' cryptocurrency funds. SpyAgent has been detected in over 280 fraudulent apps, primarily targeting users in South Korea and the UK.&nbsp;</li><li><strong>SparkCat</strong>: This malware has been found in both Android and iOS apps, masquerading as legitimate services. SparkCat uses OCR to scan photo libraries for images containing wallet recovery phrases, which are then exfiltrated to command-and-control servers. Notably, SparkCat employs a Rust-based communication mechanism, a rarity in mobile malware.&nbsp;&nbsp;</li></ul><h3>Protecting Small and Medium-Sized Businesses (SMBs) from OCR-Based Attacks&nbsp;</h3><p>SMBs can take several measures to safeguard against OCR-based cyber threats:&nbsp;</p><ul><li>Employee Education: Train staff to avoid storing sensitive information, like passwords or recovery phrases, as images on their devices.</li><li>App Vetting: Implement strict policies for installing applications, ensuring they are from reputable sources and have been vetted for security. &nbsp;</li><li>Permission Management: Monitor and restrict app permissions, especially those requesting access to storage, camera, or accessibility features. &nbsp;</li><li>Regular Audits: Conduct periodic security audits to detect and remove unauthorized or malicious applications. &nbsp;</li><li>Use of Security Software: Deploy reputable mobile security solutions that can detect and prevent malware infections. &nbsp;</li><li>Data Encryption: Encourage the use of encrypted storage solutions for sensitive information, reducing the risk of data being compromised if accessed.&nbsp;&nbsp;</li></ul><figure id="figure-gsrb9h7mgum9ucv5b1" class=""><img id="gsrb9h7mgum9ucv5b1" src="https://media.gettyimages.com/id/2178829522/photo/technological-field.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=jdbjGShmQgmVELUjPINEuuwASQ-9n7Mg7iS0G-yY_rE=" alt="Technological Field." title="Technological Field." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2178829522/photo/technological-field.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=jdbjGShmQgmVELUjPINEuuwASQ-9n7Mg7iS0G-yY_rE=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Conclusion&nbsp;</h3><p>OCR technology, while beneficial in many contexts, has been exploited by cybercriminals to extract sensitive information from images. Malware like CherryBlos, SpyAgent, and SparkCat demonstrate the evolving tactics of threat actors in targeting unsuspecting users. SMBs must remain vigilant, educating employees and implementing robust security measures to protect against these sophisticated attacks. Protecting from these attacks requires resources for training employees and continuous network monitoring. These services can require companies to hire a CISO, an expensive endeavor, TechHorizon Consulting can help with our vCISO service. We provide services like the ones mentioned for a fraction of the cost of a tradition CISO, if this interests you or your company please visit our "Contact Us" page.&nbsp;<br>&nbsp;</p>

Articles

New Malware Campaign Targets Users with Fake AI Video Edi...

Darcula: The AI-Powered Phishing Platform Fueling a Globa...

North Korean Hackers Spread Malware via Fake Job Interviews

New 'Cookie-Bite' Attack Exploits Chrome Extension to Ste...

Hackers Exploit OAuth 2.0 to Hijack Microsoft 365 Account...

How Threat Actors Exploit Optical Character Recognition i...