The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese government entity in early 2023, which leverages three modules, CGM, CGN, and COL, to hijack web sessions and access cloud services like Google Drive, Gmail, and Outlook.  By stealing cookies from a victim’s browser, CloudScout can bypass 2FA and IP tracking and enable direct data retrieval from cloud storage. However, recent security measures like Device Bound Session Credentials and App-Bound Encryption could potentially mitigate the effectiveness of this technique.  Compromise chain observed in the aforementioned network of a religious institution in Taiwan CloudScout, a malicious tool, was used in two cyberattacks targeting Taiwan.

Source: GBHackers