Ankura CTIX FLASH Update - May 30, 2025

Malware Activity

How Malicious Actors Exploit Common Tools for Stealthy Attacks

Cybercriminals and state-sponsored hackers are increasingly leveraging everyday tools like web browsers and Google Calendar to bypass traditional security measures. Recent reports reveal that sophisticated threat actors are executing Browser-in-the-Middle attacks to intercept browser communications, effectively stealing sensitive data. Simultaneously, APT41 has been observed abusing Google Calendar for covert command-and-control (C2) activities, enabling them to communicate with infected systems undetected. These tactics highlight a troubling shift towards using legitimate platforms and browser vulnerabilities to conduct espionage and data theft. Further emphasizing the need for organizations to bolster their defenses against such innovative cyber threats. CTIX analysts will continue to report on the latest malware strains and attack methodologies.