Researchers have revealed a DPAPI-based Teams token theft method allowing attackers to decrypt locally stored authentication cookies and impersonate enterprise users.

⚙️ Technical context:
- Target: msedgewebview2.exe process spawned by Teams.
- Stores AES-256-GCM encrypted cookies in a SQLite database.
- Decryption possible by extracting os_crypt.encrypted_key from Local State and unprotecting via DPAPI.
- Enables attackers to read Teams/SharePoint data and send messages as victims.

💬 SOC/DFIR pros - what’s the best detection vector here? File I/O from WebView2? Suspicious DPAPI calls?

👍 Drop your hunting ideas below, like this post & follow @technadu for continuous threat research coverage.
#MicrosoftTeams #DPAPI #Forensics #DFIR #ThreatIntel #WindowsSecurity #InfoSec #AccessTokens #EDR #SOC #CyberDefense #TechNadu

GitHub tightens npm security with mandatory 2FA, access tokens
https://www.bleepingcomputer.com/news/security/github-tightens-npm-security-with-mandatory-2fa-access-tokens/

#Infosec #Security #Cybersecurity #CeptBiro #GitHub #NpmSecurity #Mandatory2FA #AccessTokens

Gitlab access tokens now have enforced lifetime limits and pre-existing non-expiring tokens will have their lifetime reset to comply:

https://about.gitlab.com/blog/2023/10/25/access-token-lifetime-limits/

Wish I’d known this before stuff mysteriously broke when some tokens expired at midnight yesterday. All fixed now but it was a “fun” day.

#Gitlab #accessTokens