CampaignPublished 27 Aug 2025Updated 26 Sep 2025

Virtual Infrastructure Abuse leads to SaaS Hijacks

Source AlienVault OTX General

Description

This analysis examines a series of coordinated SaaS account compromises across multiple customer environments, involving suspicious logins from VPS-linked infrastructure followed by unauthorized inbox rule creation and deletion of phishing-related emails. The attackers leveraged virtual private servers (VPS) from providers like Hyonix to bypass geolocation-based defenses, evade IP reputation checks, and blend into legitimate traffic. Key tactics included session hijacking, inbox rule manipulation, and attempts to modify account recovery settings. The incidents highlight the growing abuse of VPS infrastructure in stealthy, scalable attacks targeting SaaS platforms.

Impact

For European organizations, this threat poses significant risks due to the widespread adoption of SaaS platforms for critical business operations, including email, collaboration, and customer relationship management. Successful account hijacking can lead to unauthorized data access, leakage of sensitive information, disruption of business communications, and facilitation of further phishing attacks within or outside the organization. The manipulation of inbox rules and deletion of phishing emails can delay detection and response, increasing the window of exposure. Additionally, modification of account recovery settings can lock out legitimate users, complicating incident response and recovery efforts. Given the reliance on SaaS in sectors such as finance, healthcare, and government across Europe, the threat could lead to regulatory compliance violations (e.g., GDPR breaches), reputational damage, and financial losses. The use of VPS infrastructure to evade IP-based defenses challenges traditional perimeter security models common in European enterprises, necessitating enhanced detection capabilities.

Defensive guidance

European organizations should implement multi-layered defenses tailored to counter VPS-based SaaS hijacking attacks. Specific recommendations include: 1) Enforce strong multi-factor authentication (MFA) on all SaaS accounts, preferably using hardware tokens or app-based authenticators rather than SMS, to reduce the risk of session hijacking and credential theft. 2) Deploy anomaly detection systems that monitor login patterns for unusual IP addresses, especially those associated with known VPS providers like Hyonix, and flag or block suspicious sessions. 3) Regularly audit and monitor mailbox rules and account recovery settings for unauthorized changes, employing automated alerts to detect suspicious modifications promptly. 4) Integrate threat intelligence feeds containing indicators of compromise (e.g., the listed IP addresses) into security information and event management (SIEM) systems to enhance detection of VPS-originated malicious activity. 5) Conduct user awareness training focused on recognizing phishing attempts and the risks of session hijacking. 6) Implement conditional access policies that restrict SaaS access based on device compliance, geolocation, and risk scores to limit exposure from VPS-originated logins. 7) Establish rapid incident response procedures to investigate and remediate compromised accounts, including forced password resets and revocation of active sessions. 8) Collaborate with SaaS providers to leverage their native security features and incident response support. These targeted measures go beyond generic advice by focusing on the unique aspects of VPS abuse and inbox rule manipulation in SaaS environments.

Indicators of compromise

IP addresses 8

51.36.233.224
103.131.131.44
103.211.53.84
178.173.244.27
194.49.68.244
38.240.42.160
38.255.57.212
50.229.155.2

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Aug 2025, 19:48 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

IP addresses 8

Community reviews

Related threats