NEW FINALDRAFT MALWARE ABUSES OUTLOOK MAIL SERVICE FOR STEALTHY COMMUNICATIONS

Summary from the TLDR InfoSec newsletter

Elastic Security is reporting on a new malware campaign that utilizes Outlook drafts for C2 communication. The campaign uses PathLoader, which contains static analysis defenses, to load the FinalDraft malware, which requests OAuth tokens from Microsoft to hide C2 communication in drafts. The malware accepts 37 unique commands that include data exfiltration, process injection, pass-the-hash attacks, network proxying, file operations, and Powershell execution.