Security researchers at ESET disclosed CloudScout, a previously undocumented .NET post-compromise espionage toolset operated by China-aligned threat actor Evasive Panda (also tracked as Daggerfly, Bronze Highland, and StormBamboo). CloudScout acts as a specialized extension to the group’s flagship C++ backdoor MgBot, executing “pass-the-cookie” attacks against authenticated browser sessions. Instead of targeting user credentials or generating login anomalies that trigger multi-factor authentication (MFA), MgBot exfiltrates active session cookies from SQLite databases across Google Chrome, Mozilla Firefox, and Microsoft Edge, supplying them to CloudScout to interact directly with cloud service endpoints.

CloudScout relies on a core library dubbed CommonUtilities that handles HTTP communication, session decryption, and compression. ESET identified ten distinct modules, confirming three actively targeted platforms: CGD for Google Drive file harvesting, CGM for Gmail extraction, and COL for Microsoft Outlook mailbox exfiltration. The modules parse raw HTML responses and internal web APIs, staging stolen documents and emails into encrypted ZIP archives for exfiltration via MgBot or Nightdoor backdoors. Intrusions weaponizing CloudScout targeted Taiwanese government and religious entities, deploying the framework post-exploitation following perimeter breaches.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Token theft fundamentally invalidates conditional access and MFA controls, transforming legitimate, long-lived browser sessions into unmonitored exfiltration conduits that bypass endpoint identity verification without re-authentication triggers.
• Bullet 2 — Strategic & Defender Imperative: Security teams must enforce strict cookie binding, reduce session token lifespans, deploy App-Bound Encryption defenses, and monitor abnormal API traffic originating from endpoint IPs querying SaaS providers.