Tag: outlook

4 Attack Reports | 0 Vulnerabilities

Attack reports

New Tools and Techniques of ToddyCat APT

The ToddyCat APT group has evolved its methods to gain covert access to corporate email. The report details their use of PowerShell-based TomBerBil for extracting browser data, TCSectorCopy for copying Outlook OST files, and attempts to steal OAuth tokens from Microsoft 365 processes. These tools a…

sharptokenfinder

Published: November 21, 2025

Downloadable IOCs: 0

Analyzing NotDoor: Inside APT28's Expanding Arsenal

LAB52 has identified a new backdoor called NotDoor, attributed to APT28, a Russian intelligence-linked threat group. NotDoor is a VBA macro for Outlook that monitors incoming emails for specific trigger words, enabling data exfiltration, file uploads, and command execution on victim computers. The …

dll side-loading

Published: September 3, 2025

Downloadable IOCs: 2

Amazon Gift Card Email Hooks Microsoft Credentials

The Cofense Phishing Defense Center (PDC) has identified a new credential phishing campaign that uses an Amazon e-gift card to harvest Microsoft login credentials from unsuspecting recipients in 2025.

Published: April 10, 2025

Downloadable IOCs: 2

You've Got Malware: FINALDRAFT Hides in Your Drafts

While investigating REF7707, Elastic Security Labs discovered a new family of previously unknown malware that leverages Outlook as a communication channel via the Microsoft Graph API. This post-exploitation kit includes a loader, a backdoor, and multiple submodules that enable advanced post-exploit…

microsoft graph

Published: February 14, 2025

Downloadable IOCs: 9

Click here to see more Attack Reports