Hackers have a new tool that downloads Gmail, Yahoo, Outlook inboxes – TechRadar

Iranian state-sponsored hackers have built a new tool capable of downloading Gmail, Yahoo, and Outlook inboxes, and are using it against unknown high-profile targets.

This is according to a new report from Googles Threat Analysis Group (TAG), which managed to obtain a version of the tool and perform an analysis to see just how dangerous it is.

As per the report, the tool in question is called HYPERSCAPE, and was built back in 2020 by the government-backed group known as Charming Kitten.

According to Google, the tool works on the attackers endpoint, which means victims dont have to be tricked into downloading any malware. They do, however, need to either have their account credentials compromised or session cookies stolen, as the attacker first needs to log into their account.

Once that step is achieved, the tool will trick the email service into thinking its being accessed via an outdated browser, and will switch to the basic HTML view.

After that, it will change the inboxs language to English, start opening emails one by one, and download them into the .eml format. Email messages that were marked as unread before the attack will be marked as unread afterward as well. Once that stage is done, it will delete any warning emails, revert the language back to its original state and disappear.

Apparently, the tool has so far been used against no more than two dozen accounts, all located in Iran. Google says it notified all of them via its Government Backed Attacker Warnings. The tool was written in .NET for Windows PCs, TAG added, saying it tested it with Gmail, although functionality may differ for Yahoo! and Microsoft accounts".

Earlier versions of HYPERSCAPE also allowed threat actors to request data from Google Takeout, a feature allowing users to export their data to a downloadable archive file. The feature doesnt seem to be available in the latest version, however.

The rest is here:

Hackers have a new tool that downloads Gmail, Yahoo, Outlook inboxes - TechRadar