Defending SaaS-based applications against ShinyHunters OAuth abuse | Microsoft Security Blog

Microsoft Threat Intelligence identified threat actor activity with overlapping tradecraft commonly associated with ShinyHunters, including voice phishing (vishing), supply-chain compromise, and misconfigured guest access targeting SaaS-based applications.

microsoft.com

APT-C-20 Hackers Hide Shellcode in PNG Images to Launch Fileless C# Backdoor

A well known hacking group has found a clever way to sneak malicious code past security tools, using an ordinary picture file. The group, tracked as APT-C-20 and known as APT28 or Fancy Bear, hides shellcode inside PNG images to launch a fileless backdoor written in C#. This lets attackers avoid dropping malware files on disk, making the intrusion harder to spot. The campaign begins with a booby trapped Word document sent as an email attachment, disguised as a defense related file tied to an Eastern European government. Once a victim enables macros, the document drops a hidden DLL and a disguised PNG image, then hijacks a Windows component to load code without raising alarms. The DLL pulls hidden shellcode from the image and runs it in memory, eventually deploying a remote access tool that talks to attackers through a cloud storage service. Analysts from 360 said in a report shared with Cyber Security News (CSN) that they identified the campaign while tracking APT-C-20 activity, noting the group’s tradecraft closely matches its historical operations. Their research shows the attackers combine several layers of deception, including macro encryption, hidden registry changes, and image based steganography, keeping the infection invisible for as long as possible. The impact is significant since the campaign targets government and diplomatic entities with convincing lures, and its fileless nature means antivirus tools often miss it. Since the final payload never touches disk as a standalone executable, defenders must rely on behavior based detection rather than file scanning. Organizations handling sensitive geopolitical data face heightened risk given the group’s history of espionage. APT-C-20 Hackers Hide Shellcode in PNG Images The attack starts with a document named readme.docm, a tiny file barely 469 bytes in size that shows garbled text until macros are enabled. Enabling macros reveals a decoy page about an Eastern European defense ministry, distracting the user while hidden code runs in the background. The macro is encrypted, and once unlocked it checks the environment, drops files, sets up persistence, and gathers system information before showing fake content. The malware contacts dropbox.com as a network check , then copies itself into a temp folder and writes two files to a ProgramData location, a DLL named dnxstore.dll and an image called EdgeLogo.png. Attack Chain (Source – 360) A registry key tied to a built in Windows COM class is redirected to the malicious DLL. When Windows Explorer initializes that COM object, it unknowingly loads the attacker’s code, a technique known as COM hijacking. Once loaded, dnxstore.dll checks whether it runs inside explorer.exe rather than a debugging tool, and measures time delays to detect a sandbox. If everything looks legitimate, it opens EdgeLogo.png, which appears to be a normal Edge icon but hides encrypted data using least significant bit steganography. The malware derives an encryption key, pulls hidden salt and initialization vector values from the pixels, and decrypts a small header describing where the real payload sits. The Fileless C# Backdoor Payload After extracting the metadata, the loader pulls the encrypted shellcode from the image pixels, decrypts it, and runs it entirely in memory without saving it as a file. This shellcode reflectively loads the final payload, a C# backdoor called Publish.exe, heavily obfuscated to resist analysis. Once active, the backdoor builds a unique identifier from the victim’s username and domain name, then packages system details into a JSON message that gets encrypted and sent out. Instead of a typical command and control server, it communicates through Filen.io, a cloud storage service, using multiple backup gateways so it keeps working if one node fails. It waits for instructions, exchanges encryption keys with the operator, and loads additional code sent to it. Researchers noted this reflective loading style and cloud based communication matches previous APT-C-20 activity documented in earlier reports. The security teams should treat unexpected macro enabled documents with caution and avoid opening attachments or links from unfamiliar senders. Monitoring unusual explorer.exe behavior and traffic to cloud APIs can help catch this intrusion early. Indicators of compromise (IoCs):- Type Indicator Description File readme.docm Malicious macro enabled Word document used as initial lure, 469 bytes  File dnxstore.dll Shellcode loader DLL dropped via COM hijacking  File EdgeLogo.png PNG image containing LSB steganography-hidden shellcode  File Publish.exe Final C# backdoor payload communicating via Filen.io  Domain dropbox.com Contacted during initial network reconnaissance check  Domain gateway.filen.io C2 gateway node for Filen.io based communication  Domain gateway.filen.net Backup C2 gateway node for Filen.io based communication  MD5 77014b3e77529079f041b5b9e73a013b Hash of readme.docm lure document  MD5 b077401fe3d9642345d4c3deafa60aa5 Hash of dnxstore.dll loader  MD5 1cbffddcb8e1e839737bbf6e50a80aaf Hash associated with attack component  MD5 f10d1676b570aa4d97edb844fbb5128 Hash associated with attack component  MD5 7c517d1f4385e0d6e8fa5932d17873eb Hash associated with attack component  MD5 8d416eca59188474efa3408827578588b Hash of Publish.exe C# backdoor payload  Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Prevent critical incidents and financial loss with stronger proactive defense.  Integrate a live threat feed from 15K SOC Teams . The post APT-C-20 Hackers Hide Shellcode in PNG Images to Launch Fileless C# Backdoor appeared first on Cyber Security News .

cybersecuritynews.com

Hackers Breached Klue Integration to Steal Salesforce CRM Data via OAuth Tokens

Threat actors exploited a trusted third-party SaaS integration to silently harvest enterprise CRM data, marking the latest chapter in an escalating wave of OAuth-abuse attacks targeting Salesforce ecosystems. Researchers at ReliaQuest observed attackers leveraging a compromised Klue Battlecards integration, a competitive-intelligence platform that synchronizes battlecard and win/loss data with Salesforce, to exfiltrate large volumes of customer relationship management (CRM) data from enterprise environments. In response, Salesforce has officially disabled the Klue Battlecards app’s connection to its platform pending further investigation, warning that the unusual activity “may have resulted in unauthorized access to a subset of customer data.” Salesforce confirmed the issue is not a vulnerability within its own platform, but rather a compromise of Klue’s integration service account credentials. The attackers authenticated through compromised Klue integration service accounts, generated OAuth tokens, and deployed automated Python scripts identifiable by Python-urllib user-agent strings to systematically drain CRM records via Salesforce’s REST API. The attack followed a two-phase exfiltration pattern: Phase 1 – Slow extraction: Attackers first enumerated the organization’s object catalog via GET /services/data/v59.0/sobjects , then ran sustained looped REST API queries over nearly 24 hours, paginating results through the QueryMore cursor in a pattern designed to mimic legitimate integration traffic. Phase 2 – Burst extraction: In at least one environment, attackers sent nearly 1,000 queries within a 15-minute window, trading stealth for speed — suggesting either time pressure or a targeted pivot to high-value records. A separate incident saw sustained extraction lasting over 6 hours. The CRM data accessible through the integration could include account records, contact details, deal outcomes, and pricing data, depending on how each organization scoped the integration’s permissions. ReliaQuest researchers noted the attack methodology closely mirrors campaigns attributed to ShinyHunters and UNC6395, two threat clusters responsible for high-profile Salesforce OAuth-abuse incidents throughout 2025 and 2026. In June 2025, ShinyHunters used voice phishing to trick employees into authorizing malicious connected apps, then bulk-extracted Salesforce data for extortion. In August 2025, UNC6395 stole OAuth refresh tokens from the Salesloft Drift integration and queried Salesforce data across hundreds of organizations — the closest public analog to this incident. However, attribution remains unconfirmed. Key differences exist: UNC6395 was previously used python-requests , Salesforce-CLI, and Tor infrastructure, while this activity used a generic Python-urllib agent and data-center hosting. No extortion demands or leak-site postings have been observed as of publication. The core vulnerability here is structural. Third-party SaaS integrations function as non-human identities with persistent, often broadly scoped API access to sensitive data. Because they authenticate with valid credentials, they rarely trigger the behavioral alerts associated with user account compromise, allowing a 24-hour automated query loop to run undetected from a “trusted” account. ReliaQuest’s GreyMatter platform correlated the OAuth token refresh, sustained API query spikes, and burst extraction activity into a single intrusion narrative, demonstrating why API-layer visibility is critical in integration-heavy environments. Organizations using Klue or any Salesforce-connected integration should act immediately: Revoke and rotate all credentials — including service-account passwords, OAuth refresh tokens, client secrets, and active OAuth grants. Revoking the refresh token, not just the password, is what terminates persistent access. Audit Salesforce REST API logs — hunt for unusual query volumes, repeated pagination, Python-urllib user-agents, and access from unknown IP ranges. Enforce IP allowlisting — restrict connected app and SIEM/SOAR API access to approved infrastructure only, blocking and alerting on all out-of-scope requests. ReliaQuest assesses it is highly likely that threat actors will continue targeting Salesforce-connected third-party integrations through the remainder of 2026, warning that the OAuth-abuse playbook is “repeatable, effective, and now widely adopted.” Artifact Type 138.226.246[.]94 IP Address 212.86.125[.]24 IP Address 213.111.148[.]90 IP Address 94.154.32[.]160 IP Address Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates. The post Hackers Breached Klue Integration to Steal Salesforce CRM Data via OAuth Tokens appeared first on Cyber Security News .

cybersecuritynews.com

Etherhiding: Hunting and Prevention | IFIN

So your malware sample pivoted to the blockchain. Learn how to follow the transactions and get the IOCs you need.

ifin-intel.org

Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE

thehackernews.com

GitHub pulls pin on npm's auto-run scripts

theregister.com

Binary Ninja - 5.3 Release 2

Binary Ninja is a modern reverse engineering platform with a scriptable and extensible decompiler.

binary.ninja

Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges

[...]

bleepingcomputer.com

Mini Shai-Hulud Hits Red Hat NPM Packages

Last Updated: 2026-06-01T14:50:48Z (UTC) What’s Happening Yet another “Shai-Hulud” style NPM attack, this time against Red Hat cloud services packages. Socket has the full report. Affected packages have been unpublished, but it’s unclear if new packages have yet been issued, or the root cause of the compromise identified. Actions Review the listed packages and versions for compromise. Full package list here: https://socket.dev/supply-chain-attacks/red-hat-cloud-services-package-compromise ...

discourse.ifin.network

The obfuscation game: MUT-9332 targets Solidity developers via malicious VS Code extensions | Datadog Security Labs

Analysis of a threat actor campaign targeting Solidity developers via three malicious VS Code extensions

securitylabs.datadoghq.com

How to Enter the US With Your Digital Privacy Intact

Crossing into the United States has become increasingly dangerous for digital privacy. Here are a few steps you can take to minimize the risk of Customs and Border Patrol accessing your data.

wired.com

GitHub - Zouuup/landrun: Run any Linux process in a secure, unprivileged sandbox using Landlock LSM. Think firejail, but lightweight, user-friendly, and baked into the kernel.

Run any Linux process in a secure, unprivileged sandbox using Landlock LSM. Think firejail, but lightweight, user-friendly, and baked into the kernel. - Zouuup/landrun

github.com

GitHub - Cryakl/Ultimate-RAT-Collection: For educational purposes only, exhaustive samples of 450+ classic/modern trojan builders including screenshots.

For educational purposes only, exhaustive samples of 450+ classic/modern trojan builders including screenshots. - Cryakl/Ultimate-RAT-Collection

github.com

EFF Border Search Pocket Guide

border-pocket-guide-2.pdf

eff.org

MalChela – A YARA and Malware Analysis Toolkit written in Rust

Saturday was for Python. Sunday was for Rust. After my success with the Python + YARA + Hashing, I decided to take things to the next level. Over the past few years I've created a number of Python and PowerShell scripts related to YARA and Malware Analysis. What if I combined them into a single utility? While we're at it, let's rewrite them all from scratch in Rust.

bakerstreetforensics.com