Hackers go legit: supply chain attacks explode as OAuth token heists and DLL sideloading redefine cyber espionage

By early 2026, Iranian APT groups such as MuddyWater and Seedworm had notably advanced their use of DLL sideloading, leveraging legitimately signed binaries from companies like Foremedia, SentinelOne, and Fordia to stealthily deploy espionage tools like ChromElevator. These campaigns, spanning multiple countries across Asia and the Middle East, demonstrated heightened operational discipline through the integration of PowerShell and Node.js loaders for reconnaissance, credential theft, and covert communications, marking a significant refinement in stealth and evasion tactics.

Simultaneously, Chinese APT group Mustang Panda refined DLL sideloading by exploiting trusted signed binaries such as Sogou Pinyin, Solid PDF Creator, and Citrix Receiver to deliver sophisticated backdoors like SHARDLOADER and implants like ZOHOMURK. Their campaigns emphasized persistence of the DLL sideloading execution model despite rotating infrastructure and payloads, blending malicious activity into normal cloud traffic through OAuth token abuse, which complicates detection and highlights the need for behavioral analysis over static indicators.

The evolution of DLL sideloading techniques in early to mid-2026 revealed a shift toward multi-stage execution models where malicious code activates only after specific function sequences, effectively evading sandbox detection. This abuse of legitimate Windows OS behavior—pairing signed executables with malicious DLLs—challenges defenders to monitor execution flows rather than merely suspicious DLL presence. The ongoing active development of toolkits, including modified versions of backdoors like Deedrat and Turndoor, underscores the attackers’ commitment to maintaining stealth and persistence.

The rapid adoption and refinement of DLL sideloading across Iranian and Chinese APT groups suggest an ecosystem of knowledge-sharing or 'academies' that accelerate offensive research dissemination. As noted in campaigns targeting sectors such as oil and gas in Azerbaijan, these advanced techniques quickly propagate among groups, making DLL sideloading a pervasive defense evasion method. This trend underscores the critical need for defenders to anticipate evolving execution flows and prioritize behavioral detection strategies.

By early 2026, the cybersecurity landscape witnessed a significant evolution with the emergence of Kali365, an AI-powered phishing-as-a-service kit that exploits the OAuth device code authentication flow to bypass multifactor authentication (MFA) on Microsoft 365 accounts. This sophisticated tactic allows attackers to hijack accounts without stealing passwords or MFA codes, instead capturing live OAuth tokens that grant persistent access to services like Outlook, Teams, and OneDrive, effectively undermining traditional MFA protections and necessitating enhanced token and session monitoring.

Kali365’s automation capabilities, including AI-generated phishing lures, real-time victim dashboards, and campaign templates, have dramatically lowered the technical barrier for cybercriminals, fueling a rapid surge in device-code phishing attacks across diverse sectors such as manufacturing, healthcare, education, government, and finance. Security firms like Proofpoint and Arctic Wolf have documented this uptick, while the FBI has issued multiple urgent warnings underscoring the platform’s accessibility for less-skilled attackers and its capacity to maintain persistent access even after victims change passwords.

This shift towards OAuth token abuse and MFA bypass reflects a broader transformation in initial access strategies within critical industries, particularly financial services, where attackers like the Mutant Spider group have moved away from traditional credential theft towards exploiting MFA resets and token grants. CrowdStrike’s 2026 Financial Services Threat Landscape Report highlights this trend, noting that credential theft as an initial vector has declined to 13%, supplanted by vulnerability exploitation at 31%, illustrating the growing challenges MFA faces against evolving social engineering and token-based attacks.

In response to the Kali365 threat, cybersecurity experts recommend organizations implement stringent controls such as restricting or disabling device code authentication flows via Microsoft Entra conditional access policies where feasible. These measures aim to mitigate the risk posed by OAuth token abuse, which leverages legitimate authentication mechanisms originally designed for devices like smart TVs and printers, thereby complicating detection and defense efforts in cloud environments reliant on Microsoft 365 services.

By mid-2026, supply chain attacks have dramatically expanded their scope, increasingly targeting SaaS platforms, developer tools, and cloud integrations through sophisticated OAuth token theft and exploitation of legacy credentials. The Klue/Icarus breach epitomizes this evolution, where dormant credentials issued during a 2022 pilot enabled attackers to harvest OAuth tokens linked to Salesforce and Gong, compromising nearly 200 organizations including cybersecurity vendors like Huntress and Recorded Future. This incident is part of a wider pattern, with the Icarus group claiming multiple victims and marking the third major Salesforce OAuth supply chain attack within a year, underscoring the persistent vulnerability of third-party SaaS integrations and the critical need for defense-in-depth controls beyond traditional perimeter security.

The attack surface has broadened beyond software libraries to encompass developer ecosystems and cloud platforms, as seen in a North Korean campaign that compromised over 60 npm packages via typosquatting to steal developer credentials and cryptocurrency wallets. Simultaneously, trusted third-party plugins like Joomla’s JCE Editor and LiteSpeed cPanel are actively exploited for remote code execution and privilege escalation, while compromised JavaScript CDNs such as Polyfill.io continue to appear on major brand websites including Toshiba and Samsung Smart TV. These trends highlight how attackers leverage the ubiquity and trust of developer tools and web dependencies to silently infiltrate supply chains.

Attackers are increasingly abusing legitimate cloud platforms and SaaS integrations as stealthy command-and-control and data exfiltration channels, blending malicious activity seamlessly with normal operations. The Mustang Panda group exemplifies this tactic by embedding OAuth tokens into malware targeting India’s trusted Zoho WorkDrive, enabling covert communication and data theft that evades detection by mimicking expected cloud behavior. This strategic shift to exploit widely used cloud providers—Zoho, Google Drive, Microsoft cloud—reflects a growing preference for leveraging victims’ own trusted infrastructure rather than building conspicuous attack frameworks, complicating defense efforts.

The modern supply chain’s complexity now includes cloud integrations, external sales tools, technical service providers, and shared platforms, meaning a single compromised access credential can expose sensitive data across multiple otherwise unrelated companies. The Tata Electronics breach illustrates this cascading risk, where leaked technical documents from industry giants like Apple, Tesla, and Qualcomm were accessed through trusted supplier relationships and cloud platforms. Consequently, governance and security oversight must extend beyond traditional infrastructure to encompass every vendor, software dependency, developer plugin, and cloud integration, as each represents a potential vector for widespread compromise.

APT groups embed malicious payloads within trusted SaaS and cloud services, using OAuth tokens to exfiltrate data and communicate undetected through everyday business infrastructure.