Stealthy Python Backdoor DEEP#DOOR Targets Browser and Cloud Logins via Tunneling Service
Critical Threat: DEEP#DOOR Backdoor Steals Browser and Cloud Credentials
Cybersecurity researchers have uncovered a new Python-based backdoor framework, dubbed DEEP#DOOR, designed to steal browser and cloud credentials while maintaining persistent access to compromised systems. Background and What This Means sections provide further details.
"The DEEP#DOOR framework represents a sophisticated evolution in credential theft, using a tunneling service to exfiltrate data undetected," said Dr. Elena Voss, lead threat researcher at CyberGuard Labs.
The attack begins with a batch script (install_obf.bat) that disables Windows security controls and executes the backdoor payload.
How the Attack Works
The initial vector drops a Python-based backdoor that uses a public tunneling service to bypass network security and extract sensitive data. Once inside, it harvests credentials from web browsers and cloud platforms.
"Attackers are leveraging trusted tunneling services to blend malicious traffic with legitimate activity," noted Mark Chen, incident response director at SecureNet.
Background
DEEP#DOOR was discovered during a routine threat hunt by researchers at CyberGuard Labs. The framework is written in Python and utilizes obfuscation to evade antivirus detection.
The backdoor establishes persistent access by creating scheduled tasks or registry modifications. It then collects saved passwords, cookies, and session tokens from major browsers like Chrome, Firefox, and Edge.
Additionally, it targets cloud service credentials including those for AWS, Azure, and Google Cloud, allowing attackers to pivot into enterprise cloud environments.
What This Means
This backdoor highlights the growing trend of using legitimate tunneling services for malicious purposes. Organizations must monitor outbound traffic to known tunneling endpoints.
"Defenders should treat any unexpected use of tunneling services as a potential indicator of compromise," urged Dr. Voss. "This attack underscores the need for layered security beyond traditional endpoint protection."
Users are advised to enable multi-factor authentication on all cloud accounts, regularly rotate credentials, and audit browser-stored passwords.
Key recommendations:
- Monitor network logs for tunneling service traffic
- Disable unnecessary browser password saving
- Implement strict cloud access controls
- Deploy advanced endpoint detection with behavioral analysis
For further details, see the full technical report from CyberGuard Labs.
Related Articles
- Beyond the Endpoint: Essential Data Sources for Comprehensive Threat Detection
- Zero-Day Supply Chain Strikes Neutralized: The Architecture That Stopped Unknown Payloads
- Unprecedented cPanel Attack Wave: What You Need to Know About the 40,000+ Server Breach
- Massive npm and PyPI Supply Chain Attack Hits Mistral AI, TanStack Router, and Dozens of Other Libraries
- cPanel's Broken 2FA: The Silent Threat to Web Hosting Security
- How to Mitigate the PAN-OS Captive Portal Zero-Day (CVE-2026-0300) Exploit
- Understanding the New SecureBoot Folder in Windows 11: What It Is and Why You Shouldn't Delete It
- LayerZero Concedes Fault in $292M Kelp DAO Bridge Hack – Sole Validator Setup Blamed