Table of Contents

Cyberthreat Analysis

• Threat Spotlight: Storm-0249 Moves from Mass Phishing to Precision EDR Exploitation
• ConsentFix: Browser-Native ClickFix Hijacks OAuth Grants
• Driving into the Unkown: Investigating and Addressing Security  Breaches in Vehicle Infotainment Systems | MDPI

Industry News

#NMFTACyber On Demand

Threat Spotlight: Storm-0249 Moves from Mass Phishing to Precision EDR Exploitation

ReliaQuest has observed “Storm-0249,” a seasoned initial access broker (IAB), adopting a more targeted and sophisticated approach to enabling ransomware attacks.

Once reliant on mass phishing, this financially motivated threat actor’s playbook now incorporates legitimate signed files, associated with common endpoint detection and response (EDR) tools, including SentinelOne's SentinelAgentWorker.exe, and techniques like Dynamic Link Library (DLL) sideloading, fileless execution, and domain spoofing. These methods allow them attempt bypassing defenses, infiltrate networks, maintain persistence, and operate undetected, raising serious concerns for security teams. ReliaQuest has worked with SentinelOne to finalize this analysis.

Operating within the ransomware-as-a-service (RaaS) ecosystem, Storm-0249 specializes in stealth and persistence. By selling pre-built access to ransomware affiliates, the group accelerates the time-to-impact of attacks and lower the technical barrier for operators, making them a critical enabler of ransomware campaigns.

ConsentFix: Browser-Native ClickFix Hijacks OAuth Grants

The Push browser agent recently detected and blocked a new attack technique seen targeting several Push customers. 

This is a new kind of browser-based attack technique that takes over user accounts with a simple copy and paste. If you’re already logged into the app in your browser, you don’t even need to supply creds, or pass an Multi-Factor Authentication (MFA) check—meaning it effectively circumvents phishing-resistant auth like passkeys too.

This is so different from the adversary-in-the-middle (AiTM) phish kits we usually come up against that we felt it deserved a new name. 

Enter: ConsentFix. This attack shares a lot of similarities with ClickFix/FileFix, AiTM phishing, and OAuth Consent Phishing. You can think of this as a browser-native ClickFix attack that phishes an OAuth token on a target app by getting the victim to copy and paste a URL containing OAuth key material into a phishing page. 

The campaign we detected looks to be specifically targeting Microsoft accounts by abusing the Azure CLI OAuth app. Essentially, the attacker tricks the victim into logging into Azure CLI, by generating an OAuth authorization code—visible in a localhost URL—and then pasting that URL (including the code) into an attacker-controlled page. This then creates an OAuth connection between the victim’s Microsoft account and the attacker’s Azure CLI instance.

Driving into the Unknown: Investigating and Addressing Security Breaches in Vehicle Infotainment Systems | MDPI

The rise of connected and automated vehicles has transformed in-vehicle infotainment (IVI) systems into critical gateways linking user interfaces, vehicular networks, and cloud-based fleet services. A concerning architectural reality is that hardcoded credentials like access point names (APNs) in IVI firmware create a cross-layer attack surface where local exposure can escalate into entire vehicle fleets being remotely compromised.

To address this risk, MPDI proposed a cross-layer security framework that integrates firmware extraction, symbolic execution, and targeted fuzzing to reconstruct authentic IVI-to-backend interactions and uncover high-impact web vulnerabilities such as server-side request forgery (SSRF) and broken access control. Applied across seven diverse automotive systems, including major original equipment manufacturers (OEMs) (Mercedes-Benz, Tesla, SAIC, FAW-VW, Denza), Tier-1 supplier Bosch, and advanced driver assistance systems (ADAS) vendor Minieye, our approach exposes systemic anti-patterns and demonstrates a fully realized exploit that enables remote control of approximately six million Mercedes-Benz vehicles.

All 23 discovered vulnerabilities, including seven CVEs, were patched within one month. In closed automotive ecosystems, we argue that the true measure of efficacy lies not in maximizing code coverage but in discovering actionable, fleet-wide attack paths, which is precisely what MPDI's approach delivers.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!