SecuriTricks

NuGet malware targets crypto wallets, OAuth tokens

ReversingLabs discovered malicious packages on NuGet targeting the crypto ecosystem. The campaign, starting in July 2025, involved 14 packages impersonating legitimate crypto-related tools. The malware aimed to steal crypto funds by redirecting transactions or exfiltrating secrets for wallet access…

cryptocurrency

supply chain attack

Published: December 17, 2025

Downloadable IOCs: 0

New Tools and Techniques of ToddyCat APT

The ToddyCat APT group has evolved its methods to gain covert access to corporate email. The report details their use of PowerShell-based TomBerBil for extracting browser data, TCSectorCopy for copying Outlook OST files, and attempts to steal OAuth tokens from Microsoft 365 processes. These tools a…

Published: November 21, 2025

Downloadable IOCs: 0

Cyber Criminal Groups Compromising Salesforce Instances for Data Theft and Extortion

Two cyber criminal groups, UNC6040 and UNC6395, are targeting organizations' Salesforce platforms for data theft and extortion. UNC6040 uses social engineering, particularly voice phishing, to gain access to Salesforce accounts. They trick employees into granting access or sharing credentials, then…

Published: September 15, 2025

Downloadable IOCs: 59

Google Salesforce Breach: A Deep dive into the chain and extent of the compromise

In June 2025, Google's Salesforce instance was breached by UNC6040 & UNC6240 using vishing, OAuth app abuse, and anonymity layers. The attackers stole business data of small and medium-sized clients. A parallel attack by UNC6395 compromised Salesloft Drift's Salesforce integration, affecting hundre…

Published: September 3, 2025

Downloadable IOCs: 19

Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing

Proofpoint has uncovered a sophisticated phishing campaign utilizing fake Microsoft OAuth applications to bypass multifactor authentication and steal credentials. The threat actors impersonate various enterprise apps like RingCentral, SharePoint, Adobe, and DocuSign to lure victims. The attack chai…

application impersonation

tycoon

Published: August 1, 2025

Downloadable IOCs: 0

Valentine's Day Cyber Attack Landscape: Exploiting Love Through Digital Deception

Valentine's Day 2025 has become a focal point for sophisticated cybersecurity threats, with attackers exploiting emotional vulnerabilities and seasonal shopping behaviors. A complex network of scams has emerged, including OAuth-based phishing, brand impersonation, and cryptocurrency fraud. These th…

Published: February 15, 2025

Downloadable IOCs: 0

Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication

Russian threat actors are conducting social-engineering and spear-phishing campaigns to compromise Microsoft 365 accounts using Device Code Authentication phishing. This method has proven more effective than traditional techniques. Campaigns have targeted organizations with politically-themed lures…

device code authentication

Published: February 14, 2025

Downloadable IOCs: 0

Cyberhaven’s preliminary analysis of the recent malicious Chrome extension

A phishing attack on December 24th, 2024 compromised a Cyberhaven employee's access to the Google Chrome Web Store, leading to the publication of a malicious version of their Chrome extension. This was part of a larger campaign targeting Chrome Extension developers, primarily aiming at Facebook Ads…

Published: January 2, 2025

Downloadable IOCs: 5

Tag: oauth

Attack reports

NuGet malware targets crypto wallets, OAuth tokens

New Tools and Techniques of ToddyCat APT

Cyber Criminal Groups Compromising Salesforce Instances for Data Theft and Extortion

Google Salesforce Breach: A Deep dive into the chain and extent of the compromise

Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing

Valentine's Day Cyber Attack Landscape: Exploiting Love Through Digital Deception

Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication

Cyberhaven’s preliminary analysis of the recent malicious Chrome extension