The ToddyCat APT group has developed new ways to access corporate email communications at target organizations.

Email remains the main way companies handle business communications, whether through their own servers like Microsoft Exchange or through cloud services such as Microsoft 365 and Gmail.

Many believe that cloud services provide better protection for company communications. Even when attackers break into a company’s network, email data stays in the cloud and appears safe.

However, the ToddyCat group has found ways around this assumption.

The group has evolved its methods to secretly access internal employee communications at targeted companies. Recent attacks took place during the second half of 2024 and early 2025.

These operations show how the attackers moved from traditional methods to new approaches that help them avoid detection.

Their latest technique uses a user’s browser to steal tokens for the OAuth 2.0 system, which then allows access to corporate email from outside the breached network.

Securelist security researchers identified these new attack methods and documented how ToddyCat changed its approach over time.

The group created tools that work quietly in the background, stealing authentication information and email data without triggering many security alerts.

The researchers found that ToddyCat has been constantly testing and improving its techniques to stay ahead of security teams.

Browser Data Theft Through Network Connections

The group updated its TomBerBil tool with a PowerShell version that works differently from earlier models. This new version runs on domain controllers with high-level access and reaches out to browser files across the network using the SMB protocol.

The tool collects data from Chrome, Edge, and Firefox browsers. It starts by reading a list of computer names from a file and then connects to each one through network shares.

The script creates folders to organize the stolen data and copies important browser files including Login Data, which stores saved passwords, Local State with encryption keys, Cookies files, and browsing History.

For Firefox, it grabs similar files like key3.db, signons.sqlite, key4.db, and logins.json from user profile folders. The tool also copies DPAPI encryption keys that Windows uses to protect user data.

The command to launch the tool looks like this:-

powershell -exec bypass -command "c:\programdata\ip445.ps1"

The PowerShell script builds paths to files using this approach:-

$cpath = "\{0}\c$\users\" -f $myhost
$loginDataPath = $item.FullName + "\AppData\Local\Google\Chrome\User Data\Default\Login Data"
copy-item -Force -Path $loginDataPath -Destination $dstFileName

With these stolen keys and user information, attackers can decrypt all the browser data on their own systems. The SMB protocol connections make the theft harder to spot because network file access appears normal in many environments.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post ToddyCat APT Accessing Organizations Internal Communications of Employees at Target Companies appeared first on Cyber Security News.

Cybersecurity researchers have uncovered a sophisticated Python-based malware that employs process injection techniques to hide inside legitimate Windows binaries.

This threat represents a new evolution in fileless attack strategies, combining multi-layer obfuscation with trusted system utilities to evade detection.

The malware’s ability to masquerade as harmless files while deploying a full Python runtime environment marks a significant advancement in delivery mechanisms that challenge traditional security approaches.

During a routine analysis at K7 Labs, security researchers identified this novel threat that uses a 65 MB blob containing mostly filler data with a small valid marshalled .pyc fragment hidden at the end.

This fragment contains the actual malicious code designed to inject processes into legitimate Windows executables.

The sample demonstrates several advanced features including multi-layer encoding, archive type masquerading, and bundling of a Python runtime with a signed executable name that appears legitimate to casual observation.

K7 Labs security analysts noted that the malware’s impact extends beyond initial infection, establishing persistent command-and-control communications that continue even after the original loader terminates.

The infection chain begins with a PE dropper that reconstructs a batch script through runtime decryption using SIMD operations.

This script drops config.bat into the public user directory, which then downloads a file disguised as a PNG image from cloud storage.

In reality, this PNG file is a RAR archive—a simple but effective trick that bypasses security filters treating image files as harmless.

The batch script extracts this archive using the built-in tar command, revealing three components: AsusMouseDriver.sys (a password-protected RAR disguised as a system file), Interput.json (renamed to Install.bat), and a legitimate WinRAR executable used for further extraction.

Once executed, the Python interpreter processes command-line arguments “dcconsbot” and “dcaat” to trigger a sophisticated de-obfuscation chain through Base64 decoding, BZ2 decompression, Zlib decompression, and finally marshal loading to reconstruct the compiled Python bytecode in memory.

This code immediately targets cvtres.exe, a legitimate Microsoft resource conversion utility, for process injection.

Infection Mechanism Deep Dive

The core infection mechanism leverages a carefully orchestrated multi-stage extraction process that demonstrates the attackers’ deep understanding of Windows internals and security tool behaviors.

After the initial PE dropper executes, the config.bat script establishes C:\DragonAntivirus as a working directory before downloading the disguised archive.

The Install.bat script then renames the bundled WinRAR executable and uses it to extract the password-protected AsusMouseDriver.sys archive with a hardcoded password into C:\Users\Public\WindowsSecurityA.

This directory contains the fake ntoskrnl.exe (actually a bundled Python runtime) and the Lib\image blob containing the obfuscated payload.

A decoy PDF opens to distract users while malicious code executes silently, parsing the image file through the layered de-obfuscation routine before injecting into cvtres.exe and establishing encrypted C2 communications.

# Simplified de-obfuscation chain
import base64, bz2, zlib, marshal

def deobfuscate_payload(image_data):
    # Layer 1: Base64 decoding
    stage1 = base64.b64decode(image_data)
    # Layer 2: BZ2 decompression  
    stage2 = bz2.decompress(stage1)
    # Layer 3: Zlib decompression
    stage3 = zlib.decompress(stage2)
    # Layer 4: Marshal loading (Python bytecode)
    final_payload = marshal.loads(stage3)
    return final_payload

The malware’s ability to hide within legitimate Microsoft processes while maintaining encrypted communications channels makes it particularly dangerous for enterprise environments where traditional signature-based detection may fail to identify the threat.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threats Actors Leverage Python-based Malware to Inject Process into a Legitimate Windows Binary appeared first on Cyber Security News.