SAGEMalware

“The group's methods moved from credential theft against platforms like Snowflake toward a focus on social engineering like with Salesforce.”

“Many hosts had malicious scheduled tasks executing obfuscated PowerShell scripts, and many of those hosts had PowerShell monitoring disabled.”

“…ing dozens of companies and selling nearly a billion stolen records from services like MyFitnessPal and Dubsmash, largely through credential-stuffing attacks against developers' GitHub accounts.”

“Current phase: Advanced SaaS supply-chain compromises and OAuth token theft.”

“T1199”

“… Flag new hires who avoid typical interactions (like meetings, Teams, or Outlook communication) and exclusively focus on accessing code repositories or sensitive internal data.”