Loading story…
Canarytokens were highlighted as a practical detection mechanism for both insider-threat investigations and attacker activity, including unauthorized access to sensitive files and post-exploitation behavior. In one case, investigators placed an Excel XLSX canarytoken around a suspected customer mailing list so that opening or parsing the document would trigger an outbound request and reveal access details such as the source IP address. The technique relies on embedding an external resource reference inside the Open XML package, allowing defenders to detect when a decoy or monitored document is touched.
The same reporting showed that canarytokens can also surface adversary tradecraft unexpectedly during intrusion activity. A sensitive-command token fired when a Cobalt Strike Elevate Kit user account control bypass invoked whoami, providing an early signal of hands-on-keyboard attacker behavior. The examples underscore that canarytokens can supplement detection and investigation workflows, but they do not replace core defenses such as EDR, patching, MFA, Active Directory hardening, and least-privilege controls.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
dfir.ch published an article describing the Excel canarytoken and sensitive-command canarytoken case studies, concluding that Canarytokens can provide useful early warning but are not a replacement for EDR and broader security controls.
Oddvar Moe published a blog post describing persistence using GlobalFlags in Image File Execution Options, the technique later cited as the basis for a sensitive-command canarytoken use case.
In a separate incident response case, threat actors executed or attempted the Cobalt Strike command "elevate uac-schtasks." During analysis, a previously installed whoami-sensitive-command canarytoken generated a DNS alert because the underlying technique runs "whoami /groups" to check group membership and integrity level.
The demonstrated XLSX canarytoken file was uploaded to an online Excel parsing platform, and parsing it triggered an alert email indicating that the document had been opened or processed. The article explains this worked because the XLSX contained an external relationship pointing to a canarytokens.com URL.
To determine whether the Excel data was being stolen or improperly accessed, an Excel canarytoken document was generated for controlled placement with suspected insiders or on the web server.
A company found that upcoming customer mailing targets were repeatedly leaking, with competitors contacting the same customers one or two days earlier. The suspected causes were either an insider threat or compromise of the external web server used to process uploaded Excel files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
dfir.ch
Open sourceoddvar.moe
Open sourcecanarytokens.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tracebit researchers reported that embedding defensive prompt-injection payloads, dubbed **"context bombs,"** inside canary secrets sharply reduced the effectiveness of AI agents carrying out simulated attacks in an AWS-based corporate environment. Across 152 test runs using agents powered by Anthropic Opus 4.8, Google Gemini 3.1 Pro, Zhipu AI GLM 5.2, DeepSeek 4 Pro, and Moonshot AI Kimi K2.6, the agents completed at least one attack path in 91% of baseline runs, but only 15% when the booby-trapped secrets were present. Canary alerts fired in every case, and the strongest reported impact was on Opus 4.8, which achieved full account admin access in 93% of clean runs but failed every time after encountering a context bomb. The findings were presented as a defensive adaptation to the growing view that prompt injection cannot be fully prevented, echoing guidance from the UK National Cyber Security Centre that prompt injection should not be treated like traditional input flaws such as SQL injection. In the tests, the disrupted attack paths included admin access, persistence, code execution, data exfiltration, lateral movement, targeted access, and reconnaissance. Researchers said the technique could help defenders frustrate autonomous offensive agents, while cautioning that it has not yet been validated against **"abliterated"** models with safety guardrails removed.
Jul 14, 2026
Multiple security researchers published new technical details on how **Cobalt Strike Beacon** can be modified and concealed during post-exploitation, while also outlining ways defenders can decode and detect its traffic. TrustedSec showed that Beacon’s XOR-obfuscated configuration blob can be altered in memory at runtime to change settings such as the **user-agent**, sleep and jitter values, HTTP verbs, spawn-to paths, ports, and even the active C2 destination after egress testing. Other reverse-engineering work described how Beacon resolves Windows syscalls for direct or indirect execution to evade monitoring, and how operators use **Malleable C2** profiles to shape network traffic and metadata encoding. Separate analyses highlighted how attackers increasingly hide Beacon communications behind trusted infrastructure, including **CDN services**, **domain fronting**, and **serverless reverse proxies** such as Cloudflare Workers, making attribution and blocking harder because traffic appears to target legitimate platforms. Defensive research from Unit 42, Splunk, and open-source tooling including **CobaltStrikeParser** focused on parsing Beacon configurations, decoding metadata formats such as `Base64`, `Base64URL`, `NetBIOS`, `NetBIOSU`, and `Mask`, and detecting suspicious profile settings like `spawnto_x86` and `spawnto_x64`. Together, the reports show that Cobalt Strike remains highly adaptable for adversaries and requires layered detection beyond simple perimeter filtering.
Aug 15, 2026
Researchers detailed how Microsoft nested app authentication (NAA), also called **BroCI**, can let an attacker who already holds a valid refresh token from a broker-capable Microsoft application exchange it for tokens to other apps and resources. The technique was shown against Azure and Entra ID workflows to retrieve Conditional Access Policy data, activate Privileged Identity Management roles, access Azure Key Vault secrets, and enumerate Intune devices by brokering requests through administrator portals. The write-up emphasized that MFA claims present in the original broker token can persist into downstream requests, potentially satisfying Conditional Access checks, and clarified that the method relies on **refresh tokens**, not access tokens. A separate offensive analysis showed that **VS Code Dev Tunnels** can be abused for remote access by using authenticated GitHub or Azure/Entra ID tokens to enumerate tunnels, obtain connect-scoped JWTs, establish WebSocket relay sessions, and invoke MsgPack-based RPC methods for command execution and file operations on tunnel hosts. The author said credentials stored by VS Code can still be recovered by same-user processes despite Electron `safeStorage`, and released a Rust proof-of-concept called **Ouroboros** to interact with existing tunnels. Together, the research highlights how token theft, device-code phishing, and Microsoft token pivoting techniques such as **FOCI/BroCI** can extend access across cloud administration surfaces and developer remote-access infrastructure.
Jul 24, 2026