Loading threat actor…
softwareaccess is a malicious Chrome-extension operation associated with a coordinated campaign targeting enterprise users of major HR and financial platforms, including Workday, NetSuite, and SuccessFactors. It is linked to a cluster of five browser extensions that masquerade as productivity or account-access tools while covertly stealing authentication material and enabling account takeover. The softwareaccess-branded extension shares infrastructure patterns and attack mechanisms with four related extensions published under the name databycloud1104. The operation is notable for session hijacking through theft of authentication tokens and cookies, including repeated extraction of session material to keep stolen access current. A particularly dangerous capability attributed to softwareaccess is bidirectional cookie injection, which allows attackers to import stolen session cookies into their own browser sessions and access victim accounts without needing passwords, potentially bypassing multi-factor authentication. The extensions also interfere with incident response by manipulating enterprise web application pages in the browser, monitoring page changes at high frequency, and blanking or redirecting administrative security interfaces. Observed blocking behavior has affected functions such as password resets, account deactivation, MFA device management, and access to security audit logs, creating containment challenges for defenders attempting remediation. This activity reflects a financially relevant enterprise intrusion pattern centered on unauthorized access to business platforms, session abuse, persistence within active accounts, and defense evasion through suppression of administrative controls. Known associated branding includes softwareaccess and databycloud1104.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.