Varonis Threat Labs discovered a critical vulnerability in Google Cloud Platform's Dialogflow CX service that allowed attackers with only the dialogflow.playbooks.update permission to inject persistent malicious code into the shared Cloud Run execution environment. The vulnerability enabled silent exfiltration of conversation data, bypassing VPC Service Controls, and injection of phishing prompts into chatbot conversations. Additional weaknesses included IMDS credential exposure and unrestricted outbound network access from the Cloud Run environment.
Data Exfiltration
27 posts
Rogue Agent: How a Single Code Block Could Hijack Your AI Conversations in Google’s DialogFlow Q2 2026 Attack Techniques Trend Report The Q2 2026 trend report from AhnLab ASEC documents a significant expansion of attack surfaces into AI stacks, identity infrastructure, and public-facing applications. CISA KEV listings rose 27% year-over-year to 75 entries, with ransomware-linked vulnerabilities nearly doubling. Notable developments include prompt injection-to-RCE chains in Microsoft Semantic Kernel, data exfiltration via M365 Copilot Enterprise (SearchLeak), three Microsoft Defender zero-days used for telemetry evasion, and continued AI supply chain attacks via malicious skills. The report recommends shifting from signature-based to behavior-based detection and implementing ITDR, conditional access, and AI-specific input validation controls.
The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration Researchers identified a universal bucket hijacking technique affecting major cloud providers (AWS, GCP, Azure) that allows attackers to silently exfiltrate data streams. By exploiting the global uniqueness of bucket names, an attacker with deletion privileges can delete a target bucket and recreate it in their own environment, seamlessly rerouting logs, backups, and messages without requiring granular configuration update permissions.
22nd June – Threat Intelligence Report This threat intelligence report highlights recent data breaches involving third-party vendors, emerging AI threat vectors such as prompt injection and WebSocket abuse, and active exploitation of critical vulnerabilities in Fortinet, Cisco, and Splunk products. Additionally, seasonal phishing campaigns targeting travelers and Amazon Prime members are surging alongside a cross-platform Rust-based crypto clipboard hijacker.
Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE A critical vulnerability in the Google Cloud Vertex AI SDK for Python allows attackers to achieve cross-tenant Remote Code Execution (RCE) via bucket squatting. By predicting default staging bucket names and exploiting a lack of ownership verification, attackers can intercept model uploads and inject malicious pickle payloads, leading to the theft of highly privileged service account tokens.
SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon Varonis Threat Labs discovered SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise Search (CVE-2026-42824). By chaining Parameter-to-Prompt (P2P) injection, an HTML rendering race condition, and a Server-Side Request Forgery (SSRF) via Bing's image search, attackers could exfiltrate sensitive organizational data via a single malicious link.
Phishing for Lobsters: How We Tricked OpenClaw into Spilling Secrets Varonis Threat Labs demonstrated that enterprise AI agents, specifically an OpenClaw deployment, are vulnerable to traditional phishing and social engineering techniques. In simulated attacks, the agent successfully identified technical phishing indicators like malicious OAuth flows but failed to recognize social context, resulting in the exfiltration of AWS credentials and sensitive CRM data to an external attacker.
Beyond the RaaS Headlines: The Reality of Ransomware Tradecraft The Ransomware-as-a-Service (RaaS) ecosystem relies heavily on affiliates who dictate the actual intrusion tradecraft, meaning a single ransomware brand can be associated with vastly different attack chains. Affiliates frequently abuse legitimate Remote Monitoring and Management (RMM) tools, exposed RDP, and vulnerable edge appliances for initial access, followed by the use of LOLBins and open-source utilities for persistence and data exfiltration.
GitHub Breach via Malicious VS Code Extension: What You Need to Know A malicious Visual Studio Code extension installed on a GitHub employee's endpoint provided the threat actor TeamPCP with access to exfiltrate approximately 3,800 internal repositories. The incident underscores the critical risk of IDE extensions serving as initial access vectors for supply-chain attacks, allowing threat actors to leverage developer privileges for large-scale data exfiltration.
Welcome to BlackFile: Inside a Vishing Extortion Operation UNC6671, operating under the BlackFile brand, conducts sophisticated vishing and Adversary-in-the-Middle (AiTM) attacks to bypass MFA and compromise SSO platforms like Microsoft 365 and Okta. Once inside, the group uses automated Python and PowerShell scripts to rapidly exfiltrate sensitive data via APIs, often masking their activity as routine file access events, before launching aggressive extortion campaigns.
GemStuffer Campaign Abuses RubyGems as Exfiltration Channel Targeting UK Local Government The GemStuffer campaign leverages the RubyGems package registry as an unconventional data exfiltration channel. Threat actors deploy Ruby scripts that scrape UK local government portals, package the harvested data into valid .gem archives, and push them to RubyGems using hardcoded API keys. The malware demonstrates defense evasion by overriding the HOME environment variable to a /tmp directory to isolate its credential environment, or by bypassing the gem CLI entirely to perform direct API POST requests.
108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure A coordinated campaign of 108 malicious Chrome extensions has been discovered stealing Telegram sessions, harvesting Google OAuth identities, and deploying universal backdoors. Operating as a Malware-as-a-Service platform via shared C2 infrastructure, the extensions bypass security headers and inject arbitrary content while masquerading as legitimate tools and games.
Cracks in the Bedrock: Agent God Mode The AWS Bedrock AgentCore starter toolkit automatically provisions overly permissive IAM roles that grant wildcard access across the AWS account. This "Agent God Mode" misconfiguration allows a compromised AI agent to exfiltrate ECR images, access other agents' memories, and escalate privileges by invoking other code interpreters or agents.
Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox Unit 42 researchers discovered a method to bypass the network isolation of Amazon Bedrock AgentCore's Code Interpreter sandbox using DNS tunneling. Combined with a legacy MMDSv1 configuration that lacked session token enforcement, attackers could potentially exploit SSRF to extract highly privileged IAM credentials and exfiltrate them via the DNS covert channel.
Leveling Up with NightSpire Ransomware Huntress analyzed recent NightSpire ransomware incidents, noting a shift from using native LOLBins to deploying a suite of third-party tools for persistence, discovery, and exfiltration. The variation in TTPs and tooling between incidents suggests NightSpire may operate under a Ransomware-as-a-Service (RaaS) model with multiple affiliates.
Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations Storm-1175 is a financially motivated threat actor that rapidly exploits N-day and zero-day vulnerabilities in web-facing assets to deploy Medusa ransomware. The group utilizes a high-tempo attack chain, leveraging LOLBins, RMM tools, and credential theft to move laterally and exfiltrate data before executing ransomware, often completing the entire attack lifecycle within days.
Double Agents: Exposing Security Blind Spots in GCP Vertex AI Unit 42 researchers discovered that malicious AI agents deployed in GCP Vertex AI could exploit default permission scoping to extract service agent credentials. This 'double agent' attack allows unauthorized access to consumer storage buckets, restricted Google internal infrastructure, and introduces risks of remote code execution via insecure pickle deserialization.
ChatGPT Data Leakage via a Hidden Outbound Channel in the Code Execution Runtime Check Point Research discovered a vulnerability in ChatGPT's code execution runtime that allowed silent data exfiltration and remote shell access via DNS tunneling. By using malicious prompts or custom GPTs, attackers could bypass outbound network restrictions to steal sensitive user data without triggering security warnings.
Intelligence Center Threat actors increasingly abuse legitimate native utilities, third-party tools, and cloud service clients for data exfiltration, bypassing traditional static detections. The Exfiltration Framework models the behavioral and forensic characteristics of these tools to enable detection based on execution context, network patterns, and artifact persistence rather than tool presence.
From Seconds to Story: How Huntress Managed ITDR's New Incident Report Timeline Changes Response Huntress has introduced a new Incident Report Timeline feature for its Managed ITDR platform to combat rapid, identity-driven data exfiltration in cloud environments. This feature provides a chronological narrative of attacker actions and response efforts, enabling faster decision-making and better communication for security teams and MSPs.
The Agentic Security Crisis: Why You Need to Act Now The proliferation of autonomous AI agents like OpenClaw has introduced severe security risks, including unauthorized data access and silent exfiltration via prompt injection and malicious plug-ins. To mitigate these threats, organizations must transition from local agent deployments to hardened, isolated cloud environments utilizing defense-in-depth strategies such as kernel-level eBPF monitoring and runtime prompt interception.
From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA Threat actors exploited an exposed Spring Boot Actuator endpoint and plaintext credentials found in a spreadsheet to authenticate via the legacy ROPC flow. This allowed them to bypass MFA, obtain a Microsoft Graph access token, and exfiltrate sensitive data from SharePoint Online without deploying malware.
The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know The cybercrime-as-a-service ecosystem is evolving rapidly, characterized by a shift towards trading live session tokens, the integration of generative AI for dynamic payload generation, and a preference for data exfiltration over encryption. Defenders must adapt by prioritizing identity monitoring, rapid session revocation, and recognizing the blurring lines between commodity cybercrime and state-aligned operations.
Weaponizing Telegram Bots: How Threat Actors Exfiltrate Credentials Threat actors are increasingly weaponizing the legitimate Telegram Bot API to establish Command and Control (C2) channels and exfiltrate stolen data. This technique is widely adopted across credential phishing campaigns and malware families like Agent Tesla and Pure Logs Stealer, allowing attackers to bypass traditional network defenses by blending malicious traffic with legitimate Telegram communications.
5 Malicious Rust Crates Posed as Time Utilities to Exfiltrate .env Files A coordinated supply chain attack on the Rust ecosystem involved five malicious crates masquerading as time utilities. These crates silently exfiltrated .env files containing sensitive developer credentials to a threat actor-controlled lookalike domain using background curl processes.
Iranian MOIS Actors & the Cyber Crime Connection Iranian Ministry of Intelligence and Security (MOIS) affiliated threat actors, including Void Manticore and MuddyWater, are increasingly integrating cybercriminal tools, infrastructure, and affiliate models into their operations. This strategic shift, which includes the use of commercial infostealers like Rhadamanthys and RaaS platforms like Qilin, enhances their operational capabilities while complicating attribution efforts.
Using threat modeling and prompt injection to audit Comet Trail of Bits conducted an adversarial audit of Perplexity's Comet browser, discovering prompt injection vulnerabilities that allowed the exfiltration of private user data, such as Gmail emails. By leveraging techniques like fake system instructions, fake security mechanisms, and user impersonation, attackers could manipulate the AI assistant into accessing authenticated sessions and transmitting sensitive information to external servers via URL parameters.
