Blog

Futuristic Circuit Board. Blue with electrons.

<p>Cybersecurity researchers at Varonis have unveiled a new proof-of-concept (PoC) attack dubbed "Cookie-Bite," which leverages a malicious Chrome extension to extract session cookies from Azure Entra ID (formerly Azure Active Directory). This technique enables attackers to bypass multi-factor authentication (MFA) and maintain unauthorized access to Microsoft cloud services such as Microsoft 365, Outlook, and Teams.&nbsp;</p><figure id="figure-vwhscaiaorma4fq4hv"><img id="vwhscaiaorma4fq4hv" src="https://media.gettyimages.com/id/2186611997/photo/accept-cookies-button-on-a-web-page.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=_SpA7D1624t1IUQ2n0qcqn3g694XqIlpDZhYHrvMQCk=" alt="Accept cookies button on a web page" title="Accept cookies button on a web page" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2186611997/photo/accept-cookies-button-on-a-web-page.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=_SpA7D1624t1IUQ2n0qcqn3g694XqIlpDZhYHrvMQCk=" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>How the Cookie-Bite Attack Works</h3><p>The Cookie-Bite method centers on a malicious Chrome extension designed to target specific session cookies:&nbsp;</p><p><strong>ESTSAUTH</strong>: A transient session token indicating that the user has completed MFA. It remains valid for up to 24 hours or until the browser session ends.&nbsp;</p><p><strong>ESTSAUTHPERSISTENT</strong>: A persistent session token created when users opt to "Stay signed in" or when Azure applies the Keep Me Signed In (KMSI) policy. This token can remain valid for up to 90 days.&nbsp;</p><p>By extracting these cookies, attackers can impersonate authenticated users without needing to re-enter credentials or complete MFA challenges, effectively maintaining persistent access to the victim's cloud services.&nbsp;</p><h3>Implications and Risks</h3><p>While the concept of stealing session cookies is not new, the Cookie-Bite attack is notable for its stealth and persistence. Unlike traditional phishing attacks that rely on tricking users into revealing credentials, this method operates silently in the background, making detection more challenging.&nbsp;</p><p>The attack underscores the vulnerabilities associated with browser extensions, particularly those that are malicious or have been compromised. It also highlights the limitations of MFA when session tokens can be hijacked to bypass authentication mechanisms.&nbsp;</p><h3>Mitigation Strategies</h3><p>To protect against attacks like Cookie-Bite, organizations and users should consider the following measures: </p><ul><li><strong>Restrict Extension Installations: </strong>Limit the ability to install browser extensions to trusted sources and enforce policies that prevent the use of unauthorized extensions.</li><li><strong>Monitor for Suspicious Activity:</strong> Implement monitoring solutions to detect unusual behavior, such as unexpected access patterns or the use of unauthorized extensions.</li><li><strong>Regularly Review Session Policies:</strong> Evaluate and adjust session duration settings to minimize the window of opportunity for attackers to exploit stolen tokens.</li><li><strong>Educate Users:</strong> Provide training on the risks associated with browser extensions and encourage users to report any suspicious behavior.</li></ul><figure id="figure-u1yn04qbmma4fotxd"><img id="u1yn04qbmma4fotxd" src="https://media.gettyimages.com/id/1098076470/photo/search-engine.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=kqUg1kxOBfq7rJtEAZq-4YndTpvhRpwBbCdJSfL_Sbc=" alt="Search Engine" title="Search Engine" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1098076470/photo/search-engine.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=kqUg1kxOBfq7rJtEAZq-4YndTpvhRpwBbCdJSfL_Sbc=" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>Conclusion</h3><p>The Cookie-Bite attack highlights a critical gap in cloud security: even with multi-factor authentication in place, session tokens can still be hijacked to silently bypass protections. By exploiting browser extensions—often overlooked as a security risk—this PoC demonstrates how persistent access can be maintained without raising immediate alarms. It’s a clear reminder that security must extend beyond login credentials to include tighter control over session management, browser extensions, and user behavior monitoring. If your compnay is interested in learning more about what protections are available, visit our "Contact Us" page. Our vCISO service can help your company to bolster security posture and provide things like real-time network monitoring to protect from threats.<br>&nbsp;</p>

New 'Cookie-Bite' Attack Exploits Chrome Extension to Steal Azure Entra ID Session Tokens

<p>In today's digital landscape, attackers are no longer just stealing passwords—they're exploiting trusted authentication processes themselves. A recent campaign has highlighted how even familiar login workflows can be manipulated into dangerous backdoors, posing significant risks for small and mid-sized businesses (SMBs) that heavily rely on Microsoft 365.</p><h3>The Attack: Leveraging OAuth 2.0 for Unauthorized Access</h3><p><br>Researchers at Volexity have detailed how Russian-aligned threat groups are abusing OAuth 2.0 authentication flows to compromise Microsoft 365 accounts. While the campaign initially targeted organizations linked to Ukraine and human rights efforts, the tactics employed can easily be repurposed against SMBs across various industries.</p><p>The attack begins with a seemingly innocuous outreach. Victims are contacted through messaging apps like WhatsApp or Signal by individuals impersonating European officials or Ukrainian diplomats. The pretext is an invitation to a private video meeting. As the conversation progresses, the victim is sent a link—purportedly necessary to join the call—that prompts them to log into their Microsoft account.</p><p>Instead of stealing passwords outright, the attackers request an OAuth authorization code. This code, valid for up to 60 days, grants extensive access to the victim’s Microsoft 365 account—including email, files, and potentially sensitive business data—without ever needing their credentials.</p><h3>The Broader Implications for SMBs</h3><p><br>This method echoes adversary-in-the-middle (AiTM) attacks, where attackers steal session tokens to bypass authentication. However, in this case, the attackers are exploiting legitimate OAuth flows directly, making detection even more challenging.</p><p>In some instances, the attackers went further by registering a new device on the victim’s Microsoft Entra ID (formerly Azure Active Directory) after obtaining the code. To complete the compromise, they social-engineered the victim into approving a two-factor authentication (2FA) request, claiming it was necessary to join a SharePoint site tied to the fake conference.</p><p>The sophistication of this attack is alarming—it operates within the boundaries of trusted applications and processes, making it harder to detect and prevent. For SMBs, the implications are serious. Microsoft 365 often serves as the operational core for many companies, and a compromised account could lead to stolen data, financial fraud, reputational harm, and even regulatory issues. Moreover, many smaller organizations lack dedicated security teams to monitor every login or OAuth grant event, making these attacks even more insidious.</p><figure id="figure-ypshxt78dma25nysx"><img id="ypshxt78dma25nysx" src="https://media.gettyimages.com/id/515197135/photo/smartphone-risk-alert.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=CroUQHsky6UWII0rwCTolvSvNodVwPy4OUt8TMZ_XeI=" alt="Smartphone risk alert" title="Smartphone risk alert" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/515197135/photo/smartphone-risk-alert.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=CroUQHsky6UWII0rwCTolvSvNodVwPy4OUt8TMZ_XeI=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Understanding the Mechanics: OAuth 2.0 and Device Code Phishing</h3><p><br>OAuth 2.0 is widely adopted for delegated authorization, allowing users to grant third-party applications access to their data without sharing passwords. The protocol enables single sign-on (SSO), letting users access multiple services using their Microsoft 365 credentials.</p><p>Attackers exploit this by creating malicious applications that request excessive permissions. In device code phishing attacks, victims are tricked into visiting a legitimate Microsoft URL and entering a code provided by the attacker. Once entered, the attacker gains access tokens, allowing them to impersonate the user and access their data.</p><p>These tokens can be valid for extended periods, and unless explicitly revoked, they provide persistent access to the victim's account, even if the password is changed.</p><h3>Mitigation Strategies for SMBs</h3><p><br>Protecting against such sophisticated attacks requires a multi-faceted approach:</p><ul><li>Educate Employees: Regularly train staff to recognize phishing attempts, especially those involving unexpected authentication requests or unfamiliar applications.</li><li>Implement Conditional Access Policies: Use Microsoft's Conditional Access to restrict access based on user location, device compliance, and risk levels.</li><li>Monitor OAuth Activity: Regularly review and audit OAuth consents and connected applications within your Microsoft 365 environment.</li><li>Restrict User Consent: Configure settings to prevent users from consenting to applications without administrative approval.</li><li>Utilize Phishing-Resistant MFA: Adopt multi-factor authentication methods that are resistant to phishing, such as FIDO2 security keys.</li><li>Disable Unused Authentication Flows: If device code authentication is not required, consider disabling it to reduce the attack surface.</li><li>Regularly Review Access Logs: Monitor for unusual sign-in activities, such as logins from unfamiliar locations or devices.<br></li></ul><figure id="figure-xdm2g3mx29ma25ptiw"><img id="xdm2g3mx29ma25ptiw" src="https://media.gettyimages.com/id/1518920339/photo/list-of-banking-and-credit-card-application-notifications-on-a-smartphone.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=BJxS_BhLZw8Kd-n1jZ0BDVmLdZlYdWUc-TcNZJ-j8WY=" alt="List of banking and credit card application notifications on a smartphone" title="List of banking and credit card application notifications on a smartphone" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1518920339/photo/list-of-banking-and-credit-card-application-notifications-on-a-smartphone.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=BJxS_BhLZw8Kd-n1jZ0BDVmLdZlYdWUc-TcNZJ-j8WY=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Final Thoughts</h3><p><br>OAuth 2.0, while powerful and convenient, introduces new avenues for attackers to exploit. For SMBs, it's crucial to recognize that these sophisticated attacks are not limited to large enterprises. By understanding the risks and implementing robust security measures, SMBs can better protect their digital assets and maintain the trust of their clients and partners.</p><p>If you're uncertain about your organization's current security posture or need assistance in implementing these recommendations, consider consulting with TechHorizon Consulting who can provide tailored solutions to safeguard your business.</p>

Hackers Exploit OAuth 2.0 to Hijack Microsoft 365 Accounts — What SMBs Need to Know

Stealing personal data through a laptop concept

<h3>What Is Optical Character Recognition (OCR)?&nbsp;</h3><p>Optical Character Recognition (OCR) is a technology that converts images of text—such as scanned documents, photographs, or screenshots—into readable text. It's widely used in digitizing printed documents, automating data entry, and enabling text-to-speech for accessibility. OCR systems often leverage neural networks to achieve high accuracy in text recognition. &nbsp;</p><figure id="figure-1rjj3m20qem9ucszfw"><img id="1rjj3m20qem9ucszfw" src="https://media.gettyimages.com/id/2205662677/photo/cybersecurity-data-networks-and-modern-technology-security-background-digital-shield-icon.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Dp_PP38wsSMKXUOnxhoWRCPtzCU0ResbQfQuudVVm4I=" alt="Cybersecurity, data networks, and modern technology security background. Digital shield icon protection and safety concept." title="Cybersecurity, data networks, and modern technology security background. Digital shield icon protection and safety concept." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2205662677/photo/cybersecurity-data-networks-and-modern-technology-security-background-digital-shield-icon.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Dp_PP38wsSMKXUOnxhoWRCPtzCU0ResbQfQuudVVm4I=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Malicious Use of OCR by Threat Actors</h3><p>While OCR has many legitimate uses, cybercriminals have found ways to weaponize this technology. By integrating OCR into malware, attackers can extract sensitive information from images stored on victims' devices. This approach allows them to bypass traditional security measures that monitor text inputs or clipboard activity. Instead of only reading keyboard inputs or taking screenshots that might alert antivirus programs; these strains of malware can pull text straight from the screen without interacting with computer hardware.&nbsp;</p><h3>Notable Malware Utilizing OCR</h3><ul><li><strong>CherryBlos</strong>: Discovered in 2023, CherryBlos is an Android malware that uses OCR to extract cryptocurrency wallet recovery phrases from images stored on infected devices. It also overlays fake interfaces to steal credentials and hijacks clipboard data to redirect cryptocurrency transactions. &nbsp;</li><li><strong>SpyAgent</strong>: Identified by McAfee, SpyAgent scans devices for images containing crypto wallet recovery phrases. Using OCR, it extracts these phrases and sends them to attackers, granting them access to victims' cryptocurrency funds. SpyAgent has been detected in over 280 fraudulent apps, primarily targeting users in South Korea and the UK.&nbsp;</li><li><strong>SparkCat</strong>: This malware has been found in both Android and iOS apps, masquerading as legitimate services. SparkCat uses OCR to scan photo libraries for images containing wallet recovery phrases, which are then exfiltrated to command-and-control servers. Notably, SparkCat employs a Rust-based communication mechanism, a rarity in mobile malware.&nbsp;&nbsp;</li></ul><h3>Protecting Small and Medium-Sized Businesses (SMBs) from OCR-Based Attacks&nbsp;</h3><p>SMBs can take several measures to safeguard against OCR-based cyber threats:&nbsp;</p><ul><li>Employee Education: Train staff to avoid storing sensitive information, like passwords or recovery phrases, as images on their devices.</li><li>App Vetting: Implement strict policies for installing applications, ensuring they are from reputable sources and have been vetted for security. &nbsp;</li><li>Permission Management: Monitor and restrict app permissions, especially those requesting access to storage, camera, or accessibility features. &nbsp;</li><li>Regular Audits: Conduct periodic security audits to detect and remove unauthorized or malicious applications. &nbsp;</li><li>Use of Security Software: Deploy reputable mobile security solutions that can detect and prevent malware infections. &nbsp;</li><li>Data Encryption: Encourage the use of encrypted storage solutions for sensitive information, reducing the risk of data being compromised if accessed.&nbsp;&nbsp;</li></ul><figure id="figure-gsrb9h7mgum9ucv5b1" class=""><img id="gsrb9h7mgum9ucv5b1" src="https://media.gettyimages.com/id/2178829522/photo/technological-field.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=jdbjGShmQgmVELUjPINEuuwASQ-9n7Mg7iS0G-yY_rE=" alt="Technological Field." title="Technological Field." class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/2178829522/photo/technological-field.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=jdbjGShmQgmVELUjPINEuuwASQ-9n7Mg7iS0G-yY_rE=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Conclusion&nbsp;</h3><p>OCR technology, while beneficial in many contexts, has been exploited by cybercriminals to extract sensitive information from images. Malware like CherryBlos, SpyAgent, and SparkCat demonstrate the evolving tactics of threat actors in targeting unsuspecting users. SMBs must remain vigilant, educating employees and implementing robust security measures to protect against these sophisticated attacks. Protecting from these attacks requires resources for training employees and continuous network monitoring. These services can require companies to hire a CISO, an expensive endeavor, TechHorizon Consulting can help with our vCISO service. We provide services like the ones mentioned for a fraction of the cost of a tradition CISO, if this interests you or your company please visit our "Contact Us" page.&nbsp;<br>&nbsp;</p>

How Threat Actors Exploit Optical Character Recognition in Cybersecurity Attacks

Encryption your data. Binary code and digital Lock. Hacker attack and data breach. Big data with encrypted computer code. Safe your data. Cyber internet security and privacy concept. Database storage 3d illustration

<p>Browser extensions have become deeply embedded in modern workflows—whether it’s spell checkers, ad blockers, or GenAI-powered productivity tools. While they offer convenience and enhanced user experience, a new report highlights how they also represent one of the most overlooked and underestimated attack surfaces in today’s enterprise landscape.</p><p>LayerX recently released the Enterprise Browser Extension Security Report 2025, the first report to combine marketplace data with real-world enterprise usage telemetry. The findings shine a light on the widespread use of browser extensions and the significant security implications they carry.</p><h3>Browser Extensions Are Everywhere—And Risky</h3><p>Below is a compiled list of findings reported by LayerX&nbsp;&nbsp;</p><p><br><strong>Browser extensions are nearly universal.</strong><br>According to the report, 99% of employees have browser extensions installed, and over half (52%) have more than ten running at any given time. These tools have become indispensable, but their risks are largely invisible to security teams.</p><p><strong>More than half of extensions access sensitive data.</strong><br>An alarming 53% of extensions have permissions to access sensitive information such as cookies, passwords, browsing history, and the contents of web pages. This means a single compromised extension can create an entry point into critical enterprise data.</p><p><strong>Extension publishers are often untraceable.</strong><br>The majority of these extensions are published by unknown developers—54% are associated only with generic Gmail addresses. Additionally, 79% of publishers have released just a single extension, making it extremely difficult to evaluate their trustworthiness or maintain accountability.</p><figure id="figure-va5a3gji6m9ryrxgu"><img id="va5a3gji6m9ryrxgu" src="https://media.gettyimages.com/id/1159680962/photo/word-risk.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=SjKfumYGBysI4gsLvD5SRr8X9cGq40VJ3I6lunpVKjM=" alt="Word Risk" title="Word Risk" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/1159680962/photo/word-risk.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=SjKfumYGBysI4gsLvD5SRr8X9cGq40VJ3I6lunpVKjM=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>GenAI Extensions: A Growing Threat Vector</h3><p>GenAI tools in the browser have exploded in popularity—over 20% of users now have at least one installed. But often, these extensions routinely demand high‑risk permissions, often accessing data that businesses would never voluntarily share with third parties. Before rolling out any GenAI helper to your teams, establish clear policies on what data can be used, where it’s stored, and how it’s protected.</p><h3>Outdated and Sideloaded Extensions Multiply the Risk</h3><p><br>Outdated software is often vulnerable software, and browser extensions are no exception. The report finds that 51% of extensions haven’t received updates in over a year. On top of that, 26% of enterprise extensions are sideloaded—bypassing even the basic vetting provided by official extension marketplaces.</p><p>These extensions may not be malicious by design, but their lack of maintenance or scrutiny makes them prime targets for exploitation.</p><h3>Five Recommendations for Security Teams</h3><p><br></p><p>LayerX doesn’t just highlight the problem—it offers a roadmap for security and IT teams ready to tackle this risk head‑on:</p><ol><li>Audit all browser extensions:<ul data-mce-style="list-style-type: circle;" style="list-style-type: circle;"><li>Visibility is the first step. Create a comprehensive inventory of all extensions installed across the organization.</li></ul></li><li>Categorize extensions by function and user base:<ul data-mce-style="list-style-type: circle;" style="list-style-type: circle;"><li>Some extensions pose more risk than others due to their wide usage or elevated permissions. Prioritize high-impact categories like GenAI and productivity tools.</li></ul></li><li>Enumerate extension permissions:<ul data-mce-style="list-style-type: circle;" style="list-style-type: circle;"><li>Document what each extension can access. This helps define your exposure and prioritize remediation.</li></ul></li><li>Assess and score risk:<ul data-mce-style="list-style-type: circle;" style="list-style-type: circle;"><li>Evaluate each extension based on its permissions, reputation, developer information, popularity, and installation method. Consolidate this into a unified risk score.</li></ul></li><li>Use adaptive, risk-based enforcement:<ul data-mce-style="list-style-type: circle;" style="list-style-type: circle;"><li>Use the risk scores to enforce policies that balance productivity and security—blocking high-risk extensions while allowing those that are safe and necessary.</li></ul></li></ol><figure id="figure-sushw8cbrem9ryu6cw"><img id="sushw8cbrem9ryu6cw" src="https://media.gettyimages.com/id/992095120/photo/computer-security-concept.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8kdeNznaPOuNYVIOvMOKbojY0iospO31j13zDJYQQ2E=" alt="COMPUTER SECURITY CONCEPT" title="COMPUTER SECURITY CONCEPT" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/992095120/photo/computer-security-concept.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=8kdeNznaPOuNYVIOvMOKbojY0iospO31j13zDJYQQ2E=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>Final Thoughts</h3><p><br></p><p>Browser extensions are more than just productivity boosters—they’re a growing part of your enterprise attack surface. LayerX’s 2025 report is clear, it’s time to treat browser extensions with the same scrutiny as any other software in your network.</p><p>By combining visibility, policy, and adaptive enforcement, you can let your teams enjoy the benefits of browser extensions without sacrificing security. With the right approach, you’ll turn these potential liabilities into managed assets—and keep your data, and your business, safe.<br></p><p><br></p>

Browser Extensions: The Quiet Security Risk Lurking in Enterprise

Tech-Security Digital Lock Representing Data Protection and Cybersecurity Concepts on Dark Background

<p>In the cybersecurity landscape healthcare providers have become prime targets for threat actors. The latest example of this trend is ResolverRAT, a remote access trojan (RAT) designed to infiltrate healthcare systems, exfiltrate sensitive patient data, and disrupt critical operations. &nbsp;</p><h3>What Is ResolverRAT?&nbsp;</h3><p>ResolverRAT is a new malware strain that grants attackers access to compromised systems. Once inside, the RAT can monitor user activity, steal credentials, and manipulate files. Its stealthy nature and advanced capabilities make it particularly dangerous for healthcare institutions.&nbsp;</p><p>The malware spreads primarily through phishing emails that imitate legal threats or copyright violations. These emails are often written in different languages including Hindi, Turkish, and Portuguese, to increase their effectiveness in different regions. Recipients are tricked into downloading a legitimate file, which then injects ResolverRAT into memory using reflective DLL loading. &nbsp;</p><h3>Why Healthcare Providers Are at Risk</h3><p>Healthcare organizations are being targeted due to the high value of medical data and the critical nature of their services. ResolverRAT has been observed targeting the healthcare and pharmaceutical sectors, with attacks detected starting around March 10, 2025. The malware executes entirely in memory and avoids writing to the disk which makes it difficult to detect using traditional security measures. A successful attack can lead to significant financial losses, legal repercussions, and, most concerningly, compromised patient care.&nbsp;<br></p><p>ResolverRAT is part of a larger trend of cyber threats targeting the healthcare sector. Ransomware attacks have become all too common, with some strains designed not just to encrypt but to destroy data outright. These attacks can have devastating consequences, including the loss of critical patient information. &nbsp;</p><figure id="figure-f9zhfrbncim9kh5ggj"><img id="f9zhfrbncim9kh5ggj" src="https://media.gettyimages.com/id/1412282189/photo/lock-network-technology-concept.jpg?b=1&s=2048x2048&w=0&k=20&c=1m7dCoSVTld1-_Lf5CKXgwmmh0eEu6xJWesL9K71WZM=" alt="Lock. Network Technology Concept" title="Lock. Network Technology Concept" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionX="undefined" data-positionY="undefined" data-fullWidth="false"/></figure><h3>Protecting Against ResolverRAT and Similar Threats</h3><p>To protect against ResolverRAT and other cyber threats, healthcare providers should implement the following measures:&nbsp;</p><ul><li>Regular Software Updates: Ensure all systems and applications are up to date.</li><li>Employee Training: Educate staff on &nbsp;how to recognize phishing attempts and other common attack vectors. &nbsp;</li><li>Network Segmentation: Divide networks into segments to prevent lateral movement of malware. &nbsp;</li><li>Robust Backup Strategies: Maintain regular, secure backups of data to allow fast recovery in case of an attack. &nbsp;</li><li>Incident Response Planning: Develop and regularly test a comprehensive incident response plan to ensure quick action when threats are detected.&nbsp;&nbsp;</li></ul><h3>Conclusion&nbsp;</h3><p>The rise of ResolverRAT demonstrates the urgent need for healthcare providers to enhance their cybersecurity posture. If your company is concerned about your protection from cyber threats please visit our "Contact Us" page. Our vCISO service can bolster your company's cybersecurity posture efficiently and at a lower cost than a traditional CISO. By understanding the threats in this article and implementing the discussed security measures, organizations can better protect their systems, and ensure the continuity healthcare services.&nbsp;<br>&nbsp;</p>

ResolverRAT: A New Cyber Threat Targeting Healthcare Providers

<p>Cybersecurity defenses are only as strong as the measures that keep attackers at bay—even after patches are applied. In a concerning development, Fortinet has warned customers that threat actors are retaining read-only access to compromised FortiGate VPN devices via a symlink-based post-exploitation technique, even after the initial vulnerabilities have been patched.</p><h3>What’s Happening?</h3><p><br>Earlier this week, Fortinet began sending urgent emails to its customers under the title “Notification of device compromise - FortiGate / FortiOS - Urgent action required.” These emails, designated as TLP:AMBER+STRICT, alerted customers that their FortiGate/FortiOS devices might still be compromised. According to these alerts, the issue is not due to any new vulnerability; rather, it stems from remnants left behind by threat actors after exploiting well-known vulnerabilities such as CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762.</p><figure id="figure-rztpt8gofrm9hpl5af"><img id="rztpt8gofrm9hpl5af" src="https://media.gettyimages.com/id/480621795/photo/internet-security.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=fQkPXrUueNzISjmdV1Fynae8yTzK4IHBBIesqOxJY40=" alt="Internet Security" title="Internet Security" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: center center;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/480621795/photo/internet-security.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=fQkPXrUueNzISjmdV1Fynae8yTzK4IHBBIesqOxJY40=" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure><h3>The Exploit in Detail</h3><p><br>When threat actors initially exploited vulnerable FortiGate devices using known flaws, they created symbolic links (symlinks) in the language files folder. These symlinks connected the user file system to the root file system on devices that have SSL-VPN enabled. As a result, even after the affected devices have been updated with patched FortiOS versions, the symlinks may remain. This persistence mechanism enables attackers to maintain read-only access to critical files—including device configurations—via the publicly accessible SSL-VPN web panel without being detected.</p><p>Fortinet explained:</p><p>"A threat actor used a known vulnerability to implement read-only access to vulnerable FortiGate devices. This was achieved via creating a symbolic link connecting the user file system and the root file system in a folder used to serve language files for the SSL-VPN. This modification took place in the user filesystem and avoided detection."</p><h3><br>Ongoing Threat and Broader Impact</h3><p><br>According to the Computer Emergency Response Team of France (CERT-FR), this post-exploitation technique has been used in a massive campaign in France dating back to early 2023. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged network defenders to report any incidents or anomalous activity related to Fortinet's advisory to their 24/7 Operations Center.</p><p>The persistence of these symlinks is especially alarming because it means that even after immediate vulnerabilities are patched, attackers can continue to access and potentially exploit system configurations. WatchTowr CEO Benjamin Harris warned, “In the wild exploitation is becoming significantly faster than organizations can patch... Attackers deploy capabilities designed to survive the patching, upgrade, and factory reset processes.”</p><figure id="figure-bidqlmjbysm9hpmoui"><img id="bidqlmjbysm9hpmoui" src="https://media.gettyimages.com/id/486818926/photo/cyber-attack-a06.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Hv_QYDUI63GdrWIz74Pi8Z00pkUtEpvBu7Ps9coRYsQ=" alt="Cyber Attack A06" title="Cyber Attack A06" class="object-cover bg-gray-100 rounded-lg md:rounded-xl lg:rounded-2xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://media.gettyimages.com/id/486818926/photo/cyber-attack-a06.jpg?b=1&amp;s=2048x2048&amp;w=0&amp;k=20&amp;c=Hv_QYDUI63GdrWIz74Pi8Z00pkUtEpvBu7Ps9coRYsQ=" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure><h3>Mitigation Steps and Recommendations</h3><p><br>To reduce the risk posed by these lingering symlinks, Fortinet advises customers to immediately upgrade their FortiGate/FortiOS devices to one of the latest patched versions (7.6.2, 7.4.7, 7.2.11, 7.0.17, or 6.4.16). In addition, administrators should:</p><ul><li>Review Device Configurations: Immediately check for unexpected changes in configurations that might indicate a persistent compromise.</li><li>Reset Exposed Credentials: Focus on resetting any credentials, certificates, identity tokens, and cryptographic keys that might have been exposed.</li><li>Isolate Compromised Devices: Consider isolating affected devices from the network to prevent lateral movement.</li><li>Report Incidents: Follow CISA’s guidance by reporting any suspicious activity to their Operations Center.</li></ul><h3><br>Final Thoughts</h3><p><br>The stealthy nature of this exploit underscores an important lesson: even after applying patches, residual artifacts from previous breaches can leave organizations vulnerable. These findings reinforce the need for continuous monitoring and proactive remediation efforts.</p><p>At TechHorizon Consulting, we understand that evolving cyber threats require a comprehensive and proactive security strategy. We specialize in securing networks, fortifying access controls, and performing detailed configuration reviews to help ensure your infrastructure remains secure.</p><p>Contact TechHorizon Consulting today to assess your security posture and implement advanced protection strategies against emerging cyber threats.</p>

Articles

New 'Cookie-Bite' Attack Exploits Chrome Extension to Ste...

Hackers Exploit OAuth 2.0 to Hijack Microsoft 365 Account...

How Threat Actors Exploit Optical Character Recognition i...

Browser Extensions: The Quiet Security Risk Lurking in En...

ResolverRAT: A New Cyber Threat Targeting Healthcare Prov...

Symlink Exploit Enables Continued Access to Patched Forti...