Better Security, Together

Threat actors have recently been observed exploiting legacy vulnerabilities in internet-facing Microsoft Exchange servers to inject keyloggers directly into Outlook Web Access (OWA) authentication pages. These keyloggers are embedded into legitimate login interfaces, allowing attackers to harvest credentials in plaintext while avoiding detection. Because the login pages continue to function normally, users remain unaware that their credentials are being intercepted. The malicious scripts exfiltrate captured data to attacker-controlled infrastructure, creating a covert and persistent threat.

This campaign reflects a broader shift in tactics: rather than relying on traditional malware payloads, attackers are compromising authentication mechanisms themselves to gain access. The continued presence of unpatched Exchange servers gives threat actors stable footholds for credential theft operations

A renewed wave of cyberattacks is once again targeting MOVEit Transfer, the secure file transfer solution from Progress Software. Recent reports confirm that both cybercriminals and APT groups are exploiting known and even zero-day vulnerabilities in MOVEit Transfer, putting sensitive enterprise data at risk. The uptick in malicious activity has reignited concerns following the large-scale 2023 Clop ransomware campaign, which compromised hundreds of organizations through similar flaws.

MOVEit Transfer continues to be an attractive target due to its critical role in handling privileged data transfers across industries. Despite past security updates, threat actors are actively scanning for unpatched instances to gain initial access, exfiltrate confidential data, and extort victims. Organizations relying on MOVEit should prioritize patching all instances, verify configurations, and monitor for suspicious file transfer activity to reduce their exposure to these persistent threats