Procedure examples

Pupy can interact with a victim’s Outlook session and look through folders and emails.

During HomeLand Justice, threat actors made multiple HTTP POST requests to the Exchange servers of the victim organization to transfer data.

During the SolarWinds Compromise, APT29 collected emails from specific individuals, such as executives and IT staff, using `New-MailboxExportRequest` followed by `Get-MailboxExportRequest`.

During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials within cloud services to gather data and email messages from Exchange services related to OT topics and technical work carried out within organizations.

Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.

Dragonfly has accessed email accounts using Outlook Web Access.

HAFNIUM has used web shells and MSGraph to export mailbox data.

Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.

Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.

APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.

Chimera has harvested data from remote mailboxes including through execution of \\<hostname>\c$\Users\<username>\AppData\Local\Microsoft\Outlook*.ost.

Star Blizzard has remotely accessed victims' email accounts to steal messages and attachments.

APT28 has collected emails from victim Microsoft Exchange servers.

FIN4 has accessed and hijacked online email communications using stolen credentials.

VOID MANTICORE has gathered victim email-content from victim servers.

Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet `New-MailboxExportRequest.`

Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.

LightNeuron collects Exchange emails matching rules specified in its configuration.

Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.

MailSniper can be used for searching through email in Exchange and Office 365 environments.

Kimsuky has set auto-forward rules on victim's e-mail accounts.

Scattered Spider has redirected emails notifying users of suspicious account activity.

Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.

Star Blizzard has abused email forwarding rules to monitor the activities of a victim, steal information, and maintain persistent access after compromised credentials are reset.

LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.

During Operation Wocao, threat actors collected clipboard data in plaintext.

APT38 used a Trojan called KEYLIME to collect data from the clipboard.

Kimsuky has the ability to steal data from the clipboard.

APT39 has used tools capable of stealing contents of the clipboard.

OilRig has used infostealer tools to copy clipboard data.

PAKLOG has monitored and extracted clipboard contents.

Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.

InvisibleFerret has stolen data from the clipboard using the Python project “pyperclip”. InvisibleFerret has also captured clipboard contents during copy and paste operations.

BOOKWORM has used its KBLogger.dll module to steal data saved to the clipboard.

CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.

Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.

FlawedAmmyy can collect clipboard data.

Mispadu has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.

VERMIN collects data stored in the clipboard.

MarkiRAT can capture clipboard content.

DarkComet can steal data from the clipboard.

CHIMNEYSWEEP can capture content from the clipboard.

DarkTortilla can download a clipboard information stealer module.

ROKRAT can extract clipboard data from a compromised host.

RunningRAT contains code to open and copy data from the clipboard.

Explosive has a function to use the OpenClipboard wrapper.

Clambling has the ability to capture and store clipboard data.

DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.

Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.