Loading story…
Researchers documented multiple ways attackers can hide command-and-control and data theft inside legitimate Microsoft Azure services, highlighting how trusted cloud traffic can mask malicious activity. One proof-of-concept showed Azure DevOps REST APIs being used without exploiting any software flaw: Windows malware authenticated with a Personal Access Token, queried dev.azure.com, created work items, and stored host data in task fields over HTTPS. The technique requires no attacker-owned infrastructure, blends into normal enterprise traffic, and can leave exfiltrated data preserved in Azure DevOps records until removed; the sample also reportedly avoided detection in sandbox testing.
A separate investigation tied the same cloud-abuse theme to real-world banking malware in Brazil, where a phishing campaign delivered the AllaSenha trojan through invoice-themed lures, malicious .lnk files, PowerShell and Python stages, and an in-memory Delphi loader. The malware used a DGA to reach Azure-hosted endpoints under *.brazilsouth.cloudapp.azure[.]com over raw TCP, then deployed a final payload that stole Brazilian banking credentials and 2FA material, including tokens and QR codes, while using operator-driven overlays to hijack authentication flows. The reporting underscores that Azure infrastructure is being used both experimentally and operationally as a stealthy channel for malware staging, C2, and exfiltration.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Delphi DLL "ExecutorLoader," used in the AllaSenha infection chain to inject the final payload into a renamed mshta.exe process, was compiled on 2024-05-02 10:44:22. The report identifies this loader as a key in-memory stage preceding execution of the final banking trojan.
In May 2024, a multi-stage phishing campaign impersonating Brazilian electronic invoice notifications delivered the banking trojan AllaSenha to victims in Brazil. The infection chain used malicious links, a WebDAV-hosted LNK, PowerShell and Python stages, and Azure-hosted infrastructure for staging and command-and-control.
The Azure DevOps abuse post stated that sandbox analysis by ANY.RUN reported no threats detected for the uploaded sample. The result was presented as evidence that benign-looking traffic to Microsoft cloud services can complicate detection.
A blog post demonstrated three proof-of-concept programs that abuse the Azure DevOps REST API as a covert channel for command-and-control or data exfiltration without exploiting an Azure DevOps vulnerability. The examples showed listing projects, creating work items, and storing host information in task fields over HTTPS to dev.azure.com.
HarfangLab published a report detailing AllaSenha as an AllaKore variant targeting Brazilian banking users and using Azure cloud infrastructure for C2. The report documented the phishing chain, malware stages, persistence, and targeting of Brazilian banks and 2FA artifacts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 74 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
3 references tracked. Mallory keeps watching after this page renders.
cocomelonc.github.io
Open sourceharfanglab.io
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that a cloud-focused credential theft campaign broadened beyond **AWS** to also target **Microsoft Azure** and **Google Cloud Platform**, using exposed Docker services as an initial access point. The activity, observed in June 2023 and detailed by SentinelLABS and Permiso, relied on modular shell scripts and a **UPX-packed Golang ELF** payload to collect cloud credentials, profile compromised hosts, inspect containers, and harvest environment variables from running processes. The tooling also showed worm-like behavior by scanning for exposed Docker daemons on ports `2375` and `2376` with utilities including `masscan` and `zgrab`, then exfiltrating stolen data to **AnonDNS-hosted infrastructure** protected by hardcoded HTTP credentials. Researchers said the tradecraft overlaps with tooling previously linked to **TeamTNT**, but stopped short of firm attribution because the scripts are easily reused or modified; they assessed the actor is actively refining the malware for broader cloud-focused operations against Azure and GCP environments.
Jun 29, 2026
Threat actors are increasingly using **trusted platforms**—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a **three-step malvertising chain** delivered via **Facebook paid ads** that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a **tech support scam (TSS) kit** hosted on **Microsoft Azure** infrastructure (including `web.core.windows.net`). Researchers reported rapid infrastructure churn, with **100+ domains rotated in seven days**, and targeting focused on **U.S. users** with activity concentrated on weekdays. Parallel enterprise-focused campaigns are hosting phishing infrastructure on **Microsoft Azure Blob Storage**, **Google Firebase**, and **AWS CloudFront**, using **redirect chains, CAPTCHA gates, and QR codes** to bypass automated analysis and email defenses. Analysis highlighted the use of **Adversary-in-the-Middle (AiTM)** phishing-as-a-service kits—**Tycoon2FA**, **Sneaky2FA**, and **EvilProxy**—to steal credentials and **session tokens** even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal **Dropbox** credentials: benign-looking procurement-themed emails deliver **PDF attachments** that hide clickable elements (e.g., via *AcroForms* and `FlateDecode`), which then route victims to a second-stage file hosted on **Vercel Blob** and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).
Jun 29, 2026
Security researchers reported several **social-engineering campaigns** that abuse trusted platforms to increase credibility and bypass controls. One campaign targeted wedding planners and related vendors by hijacking trust in *Microsoft Teams*: attackers used compromised legitimate email threads and impersonated legal professionals (e.g., `czimmerman@craigzlaw[.]com`) to lure victims into clicking a fake Teams meeting link that ultimately redirected to `ussh[.]life/connect/teamsfinal/9/windows`, a site masquerading as a Teams download page. Victims were prompted to download Windows executables consistent with **information-stealer** behavior (credential/browser/session-token theft and C2 exfiltration), enabling follow-on account takeover and additional phishing. Separately, a report highlighted **DKIM replay**-style phishing in which criminals abuse legitimate notification/invoice workflows from **PayPal, Apple, and DocuSign** to generate cryptographically signed emails that pass DKIM/DMARC checks; attackers place scam content (often a fake support phone number and urgency) into user-controlled fields, send the message to themselves to obtain a “clean” vendor-signed email, then forward it to targets. Another campaign used **Bing search ads** to funnel users through a newly registered domain (`highswit[.]space`) to scam pages hosted on **Microsoft Azure Blob Storage** (consistent path pattern including `werrx01USAHTML/index.html` and a phone-number parameter), presenting fake Microsoft security warnings and directing victims to call numbers such as `1-866-520-2041` and `1-833-445-4045`; Netskope observed impact across dozens of US organizations.
Jun 29, 2026