Threat Insight<p>Threat researchers at Proofpoint are tracking two ongoing, highly targeted campaigns combining OAuth redirection mechanisms with brand impersonation techniques, malware proliferation, and <a href="https://infosec.exchange/tags/Microsoft365" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Microsoft365</span></a> themed <a href="https://infosec.exchange/tags/credentialphishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>credentialphishing</span></a> for <a href="https://infosec.exchange/tags/accounttakeover" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>accounttakeover</span></a>. 🧵⤵️</p><p>Proofpoint researchers recently uncovered three previously undisclosed malicious OAuth apps, disguised as ‘Adobe Drive,’ ‘Adobe Acrobat,’ and ‘Docusign’, which are used to redirect users to webpages hosting phishing and malware delivery threats.</p><p>To avoid triggering detection solutions, the observed apps were assigned limited scopes (such as profile, email, OpenID). However, Proofpoint’s threat detection engine classified them as malicious, thus protecting Proofpoint Account Takeover Protection (<a href="https://brnw.ch/21wRhAw" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">brnw.ch/21wRhAw</span><span class="invisible"></span></a>) customers.</p><p>Observed IOCs:</p><p>App IDs<br>• 14b2864e-3cff-4d33-b5cd-7f14ca272ea4 (‘Adobe Drive’)<br>• 85da47ec-2977-40ab-af03-f3d45aaab169 (‘Adobe Drive X’)<br>• 355d1228-1537-4e90-80a6-dae111bb4d70 (‘Adobe Acrobat’)<br>• 6628b5b8-55af-42b4-9797-5cd5c148313c (‘Docusign’)</p><p>Reply URLs<br>• hxxps://li.tistateronic[.]ru/OqgX<br>• hxxps://fancy-bush-61e9sydgsyi29s.jennifer-may.workers[.]dev<br>• hxxps://fly.storage.tigris[.]dev/log/Statement.HTM<br>• hxxps://log.fly.storage.tigris[.]dev/Statement.HTM<br>• hxxps://embeds.beehiiv[.]com/2066d619-1342-40ba-893d-6d0e6eee70d5</p><p>Redirection URLs<br>• hxxps://be645c1d.bentlyerool.pages[.]dev<br>• hxxps://line.infoapollocapital[.]buzz</p><p><a href="https://infosec.exchange/tags/AccountTakeover" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AccountTakeover</span></a> <a href="https://infosec.exchange/tags/ATO" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ATO</span></a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Phishing</span></a> <a href="https://infosec.exchange/tags/Apphish" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Apphish</span></a> <a href="https://infosec.exchange/tags/CloudMalware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CloudMalware</span></a></p>