Cyber-Espionage Malware FinalDraft Exploits Outlook Drafts for Covert Operations

A newly identified malware, FinalDraft, has been leveraging Microsoft Outlook email drafts for command-and-control (C2) communication in targeted cyberattacks against a South American foreign ministry.

Elastic Security Labs uncovered the attacks, which deploy an advanced malware toolset comprising a custom loader named PathLoader, the FinalDraft backdoor, and multiple post-exploitation utilities. By exploiting Outlook drafts instead of sending emails, the malware ensures stealth, allowing threat actors to conduct data exfiltration, proxying, process injection, and lateral movement while minimizing detection risks.

The attack initiates with the deployment of PathLoader—a lightweight executable that runs shellcode, including the FinalDraft malware, retrieved from the attacker’s infrastructure. PathLoader incorporates security mechanisms such as API hashing and string encryption to evade static analysis.

FinalDraft facilitates data exfiltration and process injection by establishing communication through Microsoft Graph API, transmitting commands via Outlook drafts. The malware retrieves an OAuth token from Microsoft using a refresh token embedded in its configuration and stores it in the Windows Registry for persistent access. By leveraging drafts instead of sending emails, it seamlessly blends into M

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.