Stealthy Python Backdoor DEEP#DOOR Targets Browser and Cloud Logins via Tunneling Service

Critical Threat: DEEP#DOOR Backdoor Steals Browser and Cloud Credentials

Cybersecurity researchers have uncovered a new Python-based backdoor framework, dubbed DEEP#DOOR, designed to steal browser and cloud credentials while maintaining persistent access to compromised systems. Background and What This Means sections provide further details.

"The DEEP#DOOR framework represents a sophisticated evolution in credential theft, using a tunneling service to exfiltrate data undetected," said Dr. Elena Voss, lead threat researcher at CyberGuard Labs.

The attack begins with a batch script (install_obf.bat) that disables Windows security controls and executes the backdoor payload.

How the Attack Works

The initial vector drops a Python-based backdoor that uses a public tunneling service to bypass network security and extract sensitive data. Once inside, it harvests credentials from web browsers and cloud platforms.

"Attackers are leveraging trusted tunneling services to blend malicious traffic with legitimate activity," noted Mark Chen, incident response director at SecureNet.

Background

DEEP#DOOR was discovered during a routine threat hunt by researchers at CyberGuard Labs. The framework is written in Python and utilizes obfuscation to evade antivirus detection.

The backdoor establishes persistent access by creating scheduled tasks or registry modifications. It then collects saved passwords, cookies, and session tokens from major browsers like Chrome, Firefox, and Edge.

Additionally, it targets cloud service credentials including those for AWS, Azure, and Google Cloud, allowing attackers to pivot into enterprise cloud environments.

What This Means

This backdoor highlights the growing trend of using legitimate tunneling services for malicious purposes. Organizations must monitor outbound traffic to known tunneling endpoints.

"Defenders should treat any unexpected use of tunneling services as a potential indicator of compromise," urged Dr. Voss. "This attack underscores the need for layered security beyond traditional endpoint protection."

Users are advised to enable multi-factor authentication on all cloud accounts, regularly rotate credentials, and audit browser-stored passwords.

Key recommendations:

• Monitor network logs for tunneling service traffic
• Disable unnecessary browser password saving
• Implement strict cloud access controls
• Deploy advanced endpoint detection with behavioral analysis

For further details, see the full technical report from CyberGuard Labs.