Proton Drive
Proton Drive is an encrypted cloud storage service. Qilin ransomware affiliates used Proton Drive for data exfiltration before ransomware deployment in attacks…
Tag: Data Exfiltration
Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data
Microsoft has issued a warning about a new attack vector targeting AI agents that use the Model Context Protocol (MCP). Attackers can…
Dropbox: Cloud Storage Service
Dropbox is a cloud storage service abused by Gamaredon for data exfiltration and dead drop resolvers.
Python Infostealer: Multi-Platform Credential and Wallet Harvester
The Python infostealer deployed in this campaign harvests credentials, browser data, cryptocurrency wallets, and developer artifacts from Windows, Linux, and macOS systems.…
OpenClaw AI Agent Vulnerable to Code Execution and Data Exfiltration via Hidden Commands and Phishing
Two security teams have demonstrated that OpenClaw, a popular self-hosted AI agent, can be tricked into executing attacker-controlled code or leaking sensitive…
One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes
A critical vulnerability in Microsoft 365 Copilot Enterprise Search, dubbed SearchLeak, could have allowed attackers to exfiltrate emails, files, and MFA codes…
CVE-2026-42824: Microsoft 365 Copilot Enterprise Search Vulnerability
A critical command injection vulnerability in Microsoft 365 Copilot Enterprise Search, discovered by Varonis Threat Labs, allows one-click data exfiltration. Microsoft assigned…
Rclone
Rclone is a command-line program to manage files on cloud storage. Qilin ransomware affiliates used Rclone for data exfiltration to cloud services…
Rclone: Data Exfiltration Tool
Rclone is used by INC ransomware to exfiltrate data after staging it as password-protected archives.
Salesforce REST API: Data Access Interface
The Salesforce REST API was used by attackers to bulk retrieve CRM records after obtaining OAuth tokens from Klue's compromised integration.