Loading malware…
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The cluster ... stole Microsoft 365 access through device-code phishing run from a framework Anthropic calls “Embassy Kit.”
The cluster ... stole Microsoft 365 access through device-code phishing run from a framework Anthropic calls “Embassy Kit.”
4 distinct techniques documented for this family, organized by ATT&CK tactic.
A cloud email espionage platform used a device code phishing framework codenamed Embassy Kit to orchestrate a Microsoft 365 token theft campaign. | Victims were redirected to disposable hosting servers to retrieve malware via phishing, ClickFix, and DNS hijacking schemes.
Device-code phishing through M365 lookalike domains (“Embassy Kit”).
M365 token theft through the device-code flow.
The Microsoft 365 token theft campaign resulted in unauthorized access and exfiltration of mail records from at least eight organizations.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.