Threats Tagged 'saas abuse'

A sophisticated multi-stage phishing operation has been active since April 2025, systematically exploiting legitimate SaaS platforms and cloud services to steal corporate credentials. The campaign utilizes 232 phishing domains and 80 command-and-control servers, primarily impersonating human resources consulting firms, with Robert Half Inc. and Aquent LLC representing 50% of targeted brands. Attackers leverage legitimate platforms like Salesforce, SendGrid, and Zoho for email delivery, directing victims to fake Calendly interview pages that mimic real recruiter identities. The operation deploys an adversary-in-the-middle toolkit using browser-in-the-box techniques to create replica Google sign-in pages, capable of harvesting credentials and bypassing MFA through email, SMS, Google Authenticator, and prompt notifications. The campaign specifically targets corporate email accounts, filtering out personal providers, with stolen data exfiltrated to Render-hosted servers and Telegram bots.

An investigation has revealed a structural evolution in phishing operations where threat actors conduct entire campaigns through legitimate, enterprise-trusted cloud infrastructure rather than attacker-controlled systems. Adversaries weaponize platforms employees use daily, including cloud storage, productivity suites, and OAuth authentication endpoints. Attacks originate from legitimate Google or Microsoft systems, passing all authentication checks while linking to whitelisted cloud services. Multi-factor authentication is bypassed without touching passwords, and victim organizations show no anomalous SIEM events at compromise time. Campaigns employ five stages: delivery via provider-owned infrastructure, payload hosting on legitimate cloud storage, execution within browser memory using native APIs, credential theft through legitimate authentication flows, and persistent presence through licensed services. Detection requires behavioral analysis rather than traditional indicators, as attackers operate enti...

A sophisticated spam campaign exploited Atlassian Jira Cloud to bypass security controls and target government and corporate entities. The attackers used legitimate Atlassian Cloud infrastructure to create disposable Jira instances, leveraging the platform's trusted domain reputation. The campaign targeted specific language groups, including English, French, German, Italian, Portuguese, and Russian speakers, with tailored emails redirecting to investment scams and online casinos. The operation demonstrated high automation and abuse of SaaS workflows, highlighting the need for reassessing trust assumptions in cloud-generated emails. The campaign utilized Keitaro Traffic Distribution System for redirects and focused on organizations already using Atlassian Jira, exploiting their familiarity with Jira-related emails.

MediumCampaignUnited KingdomGermanyFrance+3#saas abuse#email security#targeted attacks