Azure Services Abused as Covert C2 and Data Exfiltration Channels

Researchers documented multiple ways attackers can hide command-and-control and data theft inside legitimate Microsoft Azure services, highlighting how trusted cloud traffic can mask malicious activity. One proof-of-concept showed Azure DevOps REST APIs being used without exploiting any software flaw: Windows malware authenticated with a Personal Access Token, queried dev.azure.com, created work items, and stored host data in task fields over HTTPS. The technique requires no attacker-owned infrastructure, blends into normal enterprise traffic, and can leave exfiltrated data preserved in Azure DevOps records until removed; the sample also reportedly avoided detection in sandbox testing.

A separate investigation tied the same cloud-abuse theme to real-world banking malware in Brazil, where a phishing campaign delivered the AllaSenha trojan through invoice-themed lures, malicious .lnk files, PowerShell and Python stages, and an in-memory Delphi loader. The malware used a DGA to reach Azure-hosted endpoints under *.brazilsouth.cloudapp.azure[.]com over raw TCP, then deployed a final payload that stole Brazilian banking credentials and 2FA material, including tokens and QR codes, while using operator-driven overlays to hijack authentication flows. The reporting underscores that Azure infrastructure is being used both experimentally and operationally as a stealthy channel for malware staging, C2, and exfiltration.