Cybersecurity
CSuite phishing steals Microsoft 365 sessions
ANY.RUN said a CSuite phishing campaign used business-themed lures to steal Microsoft 365 sessions or install remote-access tools, with most related sandbox submissions coming from the United States.
- ANY.RUN researchers said they traced CSuite phishing activity across 351 sandbox analyses.
- They said 51% of the related submissions came from the United States and 18% from India.
- The campaign used lures themed around Adobe, DocuSign, Zoom, Google Meet, Dropbox and Microsoft 365.
- ANY.RUN said the operation could either install remote-access tools such as ScreenConnect or Action1, or try to capture Microsoft 365 credentials and active sessions.
- In one sandbox case, an Adobe-themed lure delivered a BAT file that raised privileges and installed ScreenConnect.
ANY.RUN said it had tracked CSuite phishing across 351 sandbox analyses. It said 51% of the related submissions came from the United States, while 18% came from India.
The campaign used business-themed lures built around Adobe, DocuSign, Zoom, Google Meet, Dropbox and Microsoft 365. According to the article, it then split into two paths: one installed remote-access software, and the other sought Microsoft 365 access and live sessions.
ANY.RUN said one path used installers, archives and small BAT or VBS droppers to place legitimate management tools such as ScreenConnect or Action1 on victims’ systems. The other path relied on credential-harvesting or device-code phishing to obtain account access.
In one sandbox example, an Adobe-themed lure delivered a BAT file that raised privileges and installed ScreenConnect. ANY.RUN said analysts could follow the chain from lure to browser activity, script execution, payload delivery and remote-access installation, and that a recurring path, /m/js/utils.js, helped it find related activity.
Named in this story
Companies
- Adobe
- was used in phishing lures
- DocuSign
- was used in phishing lures
- Zoom
- was used in phishing lures
- Dropbox
- was used in phishing lures
Organisations
- ANY.RUN
- said it traced the campaign and promoted its sandbox and threat-intelligence products
Products and systems
- CSuite
- was the name used for the phishing campaign
- Microsoft 365
- was targeted for session theft
- Google Meet
- was used in phishing lures
- ScreenConnect
- was installed to provide remote access
- Action1
- was installed to provide remote access
Places
- United States
- was where 51% of related submissions came from
- India
- accounted for 18% of related submissions
How the source tells it
The piece mixed threat reporting with vendor promotion, using urgency and worst-case incident language to push ANY.RUN’s products and services.
- vendor boosterism product capability claims and performance percentages were repeated as promotional proof
- urgency the text used repeated calls to prioritise detection, visibility and containment
- threat inflation it described likely consequences in worst-case terms such as persistent access and wider business disruption