Article
Browser Threats Evolve to Distribute Malware Through OneDrive and Microsoft Teams
Arete Analysis
Cyber Threats
Cybersecurity Trends
Threat researchers published an update to a technique that allows threat actors to evade common security measures by injecting malware through web browsers. Using social engineering techniques, threat actors can execute malicious code using Microsoft OneDrive and Teams applications. The new technique, referred to as browser cache smuggling, is the latest in attacks using web browsers to evade many common security measures, including endpoint detection and response (EDR) solutions.
What’s Notable and Unique
To enhance efficiency, modern browsers cache static files (such as photos and JavaScript), and threat actors take advantage of this by hiding malicious dynamic link library (DLL) files on a website under the guise of harmless content, such as pictures.
Threat actors then use social engineering to get victims to run a PowerShell command that finds the cached DLL and relocates it to a high-risk directory, like the localappdata directories in OneDrive or Microsoft Teams. The threat actors then use OneDrive and Teams to load and execute the malicious content using a technique called DLL proxying.
Analyst Comments
Threat actors have historically injected malicious code through web browsers and, more recently, leveraged social engineering techniques to get users to run malicious PowerShell commands. They then separately used DLL proxying to load malicious content. This newly published technique enables threat actors to combine these two capabilities. The combination enables threat actors to move further through an attack while evading defenses. It is likely that additional ransomware and extortion groups will adopt this new technique to improve the success of their operations.
Threat actors’ increased use of social engineering to get users to execute malicious code demonstrates the importance of limiting user access to scripting engines. General users likely do not need PowerShell, Python, Docker, or similar tools enabled on their desktops. Role-based application control is critical to preventing the effectiveness of this and similar techniques currently used by ransomware groups. To effectively detect the use of the browser cache to enable this new technique, organizations should consider specific EDR detections for any application except a browser accessing the browser cache. At Arete, these types of detections are applied through Arete BloktdSM, our next-generation threat identification and protection service that enhances EDR tools with custom threat detection rules that act autonomously in seconds to proactively identify threats and prevent cyberattacks.
Sources
Back to Blog Posts
Article
Ransomware Trends & Data Insights: March 2026
The threat landscape in March had a much more even distribution of threat groups than has been observed since the first half of 2025. Although Akira, Qilin, Play, and INC remained among the most active groups, Arete observed 21 unique ransomware and extortion groups in March, compared to only 15 in February. Akira and Qilin’s activity also declined from the previous month; in February, the two groups were responsible for almost half of all ransomware incidents, but in March they only comprised a little more than a quarter of all activity. Arete also observed activity from several emerging groups in the past month, including BravoX, NightSpire, Payouts King, and Securotrop.
Figure 1. Activity from the top 5 threat groups in March 2026
Analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
In March, threat actors actively exploited FortiGate Next-Generation Firewall appliances as initial access vectors to compromise enterprise networks. The activity involves the exploitation of recently disclosed security vulnerabilities, including CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858, or weak credentials, allowing attackers to gain administrative access, extract configuration files, and obtain service account credentials. Arete also observed Fortinet device exploitation involving various threat groups, with the Qilin ransomware group notably leveraging Fortinet device exploits.
Phishing campaigns leveraging OAuth redirection and a resurgence of Microsoft Teams–based social engineering were also observed in March. In one campaign, attackers sent emails disguised as Microsoft Teams recordings or Microsoft 365 alerts, redirecting victims through legitimate OAuth endpoints to attacker-controlled pages hosting malicious ZIP payloads. A separate campaign has been ongoing since last year, in which attackers flood users’ inboxes with spam and impersonate IT support personnel to trick victims into initiating remote support sessions via tools like Quick Assist.
Arete recently released its 2025 Annual Crimeware Report. Leveraging data and intelligence collected during ransomware and extortion incident response engagements, this report highlights notable trends and shifts in the threat landscape throughout 2025, including Akira’s unusually high activity levels in the second half of 2025, evolving social engineering techniques, and trends in ransom demands and impacted industries.
Sources
Arete Internal
Report
Arete's 2025 Annual Crimeware Report
Harness Arete’s unique data and expertise on extortion and ransomware to inform your response to the evolving threat landscape.
Article
FortiGate Exploits Enable Network Breaches and Credential Theft
A recent security report indicates that threat actors are actively exploiting FortiGate Next-Generation Firewall (NGFW) appliances as initial access vectors to compromise enterprise networks. The activity leverages recently disclosed vulnerabilities or weak credentials to gain unauthorized access and extract configuration files, which often contain sensitive information, including service account credentials and detailed network topology data.
Analysis of these incidents shows significant variation in attacker dwell time, ranging from immediate lateral movement to delays of up to two months post-compromise. Since these appliances often integrate with authentication systems such as Active Directory and Lightweight Directory Access Protocol (LDAP), their compromise can grant attackers extensive access, substantially increasing the risk of widespread network intrusion and data exposure.
What’s Notable and Unique
The activity involves the exploitation of recently disclosed security vulnerabilities, including CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858, or weak credentials, allowing attackers to gain administrative access, extract configuration files, and obtain service account credentials and network topology information.
In one observed incident, attackers created a FortiGate admin account with unrestricted firewall rules and maintained access over time, consistent with initial access broker activity. After a couple of months, threat actors extracted and decrypted LDAP credentials to compromise Active Directory.
In another case, attackers moved from FortiGate access to deploying remote access tools, including Pulseway and MeshAgent, while also utilizing cloud infrastructure such as Google Cloud Storage and Amazon Web Services (AWS).
Analyst Comments
Arete has identified multiple instances of Fortinet device exploitation for initial access, involving various threat actors, with the Qilin ransomware group notably leveraging Fortinet device exploits. Given their integration with systems like Active Directory, NGFW appliances remain high-value targets for both state-aligned and financially motivated actors. In parallel, Arete has observed recent dark web activity involving leaked FortiGate VPN access, further highlighting the expanding risk landscape. This aligns with the recent reporting from Amazon Threat Intelligence, which identified large-scale compromises of FortiGate devices driven by exposed management ports and weak authentication, rather than vulnerability exploitation. Overall, these developments underscore the increasing focus on network edge devices as entry points, reinforcing the need for organizations to strengthen authentication, restrict external exposure, and address fundamental security gaps to mitigate the risk of widespread compromise.
Sources
FortiGate Edge Intrusions | Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise
Article
Vulnerability Discovered in Anthropic’s Claude Code
Security researchers discovered two critical vulnerabilities in Anthropic's agentic AI coding tool, Claude Code. The vulnerabilities, tracked as CVE-2025-59536 and CVE-2026-21852, allowed attackers to achieve remote code execution and to compromise a victim's API credentials. The vulnerabilities exploit maliciously crafted repository configurations to circumvent control mechanisms. It should be noted that Anthropic worked closely with the security researchers throughout the process, and the bugs were patched before the research was published.
What’s Notable and Unique
The configuration files .claude/settings.json and .mcp.json were repurposed to execute malicious commands. Because the configurations could be applied immediately upon starting Claude Code, the commands ran before the user could deny permissions via a dialogue prompt, or they bypassed the authentication prompt altogether.
.claude/settings.json also defines the endpoint for all Claude Code API communications. By replacing the default localhost URL with a URL they own, an attacker could redirect traffic to infrastructure they control. Critically, the authentication traffic generated upon starting Claude Code included the user's full Anthropic API key in plain text and was sent before the user could interact with the trust dialogue.
Restrictive permissions on sensitive files could be bypassed by simply prompting Claude Code to create a copy of the file's contents, which did not inherit the original file's permissions. A threat actor using a stolen API key could gain complete read and write access to all files within a workspace.
Analyst Comments
The vulnerabilities and attack paths detailed in the research illustrate the double-edged nature of AI tools. The speed, scale, and convenience characteristics that make AI tools attractive to developer teams also benefit threat actors who use them for nefarious purposes. Defenders should expect adversaries to continue seeking ways to exploit configurations and orchestration logic to increase the impact of their attacks. Organizations planning to implement AI development tools should prioritize AI supply-chain hygiene and CI/CD hardening practices.
Sources
Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files | CVE-2025-59536 | CVE-2026-21852