InfoSecBulletin Cybersecurity for mankind
Hackers are using HTTP client tools for advanced account takeover attacks on Microsoft 365. Seventy-eight percent of Microsoft 365 tenants have been targeted by attacks, showing the changing tactics of threat actors. HTTP client tools are software that allows users to send HTTP requests and receive responses from web servers.
These tools enable customization of request methods (like GET, POST, PUT, DELETE), headers, and payloads, making them useful for both legitimate and malicious activities.
CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws
Ballista Botnet infects 6000 Unpatched TP-Link Routers
CVE-2025-24813
Flaw in Apache Tomcat Exposes Servers to RCE
CISA Adds 3 Ivanti Endpoint Manager Bugs to KEV
Ransomware Attacks Set Records in February: New Data Shows
Cyber attack at Japanese telecom leader NTT hits 18,000 companies
Cyber heist: Pune losses Rs 6007 crore in cyber scam
Nearly 1 million airport lost and found records leaked
Exploiting CVE-2024-4577, Attackers Target Japan with Cobalt Strike
In February 2018, Proofpoint researchers found a widespread campaign targeting Microsoft 365 environments that used an unusual version of the OkHttp client (‘okhttp/3.2.0’).
Proofpoint researchers observed that a nearly four-year campaign targeted high-value individuals, particularly C-level executives and privileged users.
Attackers used user enumeration to find valid email addresses before launching spear phishing and password spraying attacks.
Since 2018, HTTP clients have been key in account takeover (ATO) attacks. By early 2024, OkHttp variants were popular, but by March 2024, a wider variety of HTTP clients emerged.
A recent campaign using the Axios HTTP client successfully compromised 43% of targeted user accounts. When combined with Adversary-in-the-Middle (AiTM) platforms like Evilginx, Axios can steal credentials, MFA tokens, and session tokens. To read full report click here.
Google patches 47 Android flaws, Including Actively Exploited CVE-2024-53104
