April 8, 2024

Balada Injector: Darktrace’s Investigation into the Malware Exploiting WordPress Vulnerabilities

This blog explores Darktrace’s detection of Balada Injector, a malware known to exploit vulnerabilities in WordPress to gain unauthorized access to networks. Darktrace was able to define numerous use-cases within customer environments which followed previously identified patterns of activity spikes across multiple weeks.

Written by

Justin Torres

Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Justin Torres

Cyber Analyst

Apr 2024

Introduction

With millions of users relying on digital platforms in their day-to-day lives, and organizations across the world depending on them for their business operations, they have inevitably also become a prime target for threat actors. The widespread exploitation of popular services, websites and platforms in cyber-attacks highlights the pervasive nature of malicious actors in today’s threat landscape.

A prime illustration can be seen within the content management system WordPress. Its widespread use and extensive plug-in ecosystem make it an attractive target for attackers aiming to breach networks and access sensitive data, thus leading to routine exploitation attempts. In the End of Year Threat Report for 2023, for example, Darktrace reported that a vulnerability in one WordPress plug-in, namely an authentication bypass vulnerability in miniOrange's Social Login and Register. Darktrace observed it as one of the most exploited vulnerabilities observed across its customer base in the latter half of 2023.

Between September and October 2023, Darktrace observed a string of campaign-like activity associated with Balada Injector, a malware strain known to exploit vulnerabilities in popular plug-ins and themes on the WordPress platform in order to inject a backdoor to provide further access to affected devices and networks. Thanks to its anomaly-based detection, Darktrace DETECT™ was able to promptly identify suspicious connections associated with the Balada Injector, ensuring that security teams had full visibility over potential post-compromise activity and allowing them to act against offending devices.

What is Balada Injector?

The earliest signs of the Balada Injector campaign date back to 2017; however, it was not designated the name Balada Injector until December 2022 [1]. The malware utilizes plug-ins and themes in WordPress to inject a backdoor that redirects end users to malicious and fake sites. It then exfiltrates sensitive information, such as database credentials, archive files, access logs and other valuable information which may not be properly secured [1]. Balada Injector compromise activity is also reported to arise in spikes of activity that emerge every couple of weeks [4].

In its most recent attack activity patterns, specifically in September 2023, Balada Injector exploited a cross-site scripting (XSS) vulnerability in CVE-2023-3169 associated with the tagDiv composer plug-in. Some of the injection methods observed included HTML injections, database injections, and arbitrary file injections. In late September 2023, a similar pattern of behavior was observed, with the ability to plant a backdoor that could execute PHP code and install a malicious WordPress plug-in, namely ‘wp-zexit’.

According to external security researchers [2], the most recent infection activity spikes for Balada Injector include the following:

Pattern 1: ‘stay.decentralappps[.]com’ injections

Pattern 2: Autogenerated malicious WordPress users

Pattern 3: Backdoors in the Newspaper theme’s 404.php file

Pattern 4: Malicious ‘wp-zexit’ plug-in installation

Pattern 5: Three new Balada Injector domains (statisticscripts[.]com, dataofpages[.]com, and listwithstats[.]com)

Pattern 6: Promsmotion[.]com domain

Darktrace’s Coverage of Balada Injector

Darktrace detected devices across multiple customer environments making external connections to the malicious Balada Injector domains, including those associated with aforementioned six infection activity patterns. Across the incidents investigated by Darktrace, much of the activity appeared to be associated with TLS/SSL connectivity, related to Balada Injector endpoints, which correlated with the reported infection patterns of this malware. The observed hostnames were all recently registered and, in most cases, had IP geolocations in either the Netherlands or Ukraine.

In the observed cases of Balada Injector across the Darktrace fleet, Darktrace RESPOND™ was not active on the affected customer environments. If RESPOND had been active and enabled in autonomous response mode at the time of these attacks, it would have been able to quickly block connections to malicious Balada Injector endpoints as soon as they were identified by DETECT, thereby containing the threat.

Looking within the aforementioned activity patterns, Darktrace identified a Balada Injector activity within a customer’s environment on October 16, 2023, when a device was observed making a total of 9 connection attempts to ‘sleep[.]stratosbody[.]com’, a domain that had previously been associated with the malware [2]. Darktrace recognized that the endpoint had never been seen on the network, with no other devices having connected to it previously, thus treated it as suspicious.

Figure 1: The connection details above demonstrate 100% rare external connections were made from the internal device to the ‘sleep[.]stratosbody[.]com’ endpoint.

Similarly, on September 21, 2023, Darktrace observed a device on another customer network connecting to an external IP that had never previously been observed on the environment, 111.90.141[.]193. The associated server name was a known malicious endpoint, ‘stay.decentralappps[.]com’, known to be utilized by Balada Injector to host malicious scripts used to compromise WordPress sites. Although the ‘stay.decentralappps[.]com’ domain was only registered in September 2023, it was reportedly used in the redirect chain of the aforementioned stratosbody[.com] domain [2]. Such scripts can be used to upload backdoors, including malicious plug-ins, and create blog administrators who can perform administrative tasks without having to authenticate [2].

Figure 2: Advance Search results displaying the metadata logs surrounding the unusual connections to ‘stay.decentralappps[.]com’. A total of nine HTTP CONNECT requests were observed, with status messages “Proxy Authorization Required” and “Connection established”.

Darktrace observed additional connections within the same customer’s environment on October 10 and October 18, specifically SSL connections from two distinct source devices to the ‘stay.decentralappps[.]com’ endpoint. Within these connections, Darktrace observed the normalized JA3 fingerprints, “473f0e7c0b6a0f7b049072f4e683068b” and “aa56c057ad164ec4fdcb7a5a283be9fc”, the latter of which corresponds to GitHub results mentioning a Python client (curl_cffi) that is able to impersonate the TLS signatures of browsers or JA3 fingerprints [8].

Figure 3: Advanced Search query results showcasing Darktrace’s detection of SSL connections to ‘stay.decentralappps[.]com over port 443.

On September 29, 2023, a device on a separate customer’s network was observed connecting to the hostname ‘cdn[.]dataofpages[.]com’, one of the three new Balada Injector domains identified as part of the fifth pattern of activity outlined above, using a new SSL certificate via port 443. Multiple open-source intelligence (OSINT) vendors flagged this domain as malicious and associated with Balada Injector malware [9].

Figure 4: The Model Breach Event Log detailing the Balada Injector-related connections observed causing the ‘Anomalous External Activity from Critical Network Device’ DETECT model to breach.

On October 2, 2023, Darktrace observed the device of another customer connecting to the rare hostname, ‘js.statisticscripts[.]com’ with the IP address 185.39.206[.]161, both of which had only been registered in late September and are known to be associated with the Balada Injector.

Figure 5: Model Breach Event Log detailing connections to the hostname ‘js.statisticscripts[.]com’ over port 137.

On September 13, 2023, Darktrace identified a device on another customer’s network connecting to the Balada Injector endpoint ‘stay.decentralappps[.]com’ endpoint, with the destination IP 1.1.1[.]1, using the SSL protocol. This time, however, Darktrace also observed the device making subsequent connections to ‘get.promsmotion[.]com’ a subdomain of the ‘promsmotion[.]com’ domain. This domain is known to be used by Balada Injector actors to host malicious scripts that can be injected into the WordPress Newspaper theme as potential backdoors to be leveraged by attackers.

In a separate case observed on September 14, Darktrace identified a device on another environment connecting to the domain ‘collect[.]getmygateway[.]com’ with the IP 88.151.192[.]254. No other device on the customer’s network had visited this endpoint previously, and the device in question was observed repeatedly connecting to it via port 443 over the course of four days. While this specific hostname had not been linked with a specific activity pattern of Balada Injector, it was reported as previously associated with the malware in September 2023 [2].

Figure 6: Model Breach Event Log displaying a customer device making repeated connections to the endpoint ‘collect[.]getmygateway[.]com’, breaching the DETECT model ‘Repeating Connections Over 4 Days’.

In addition to DETECT’s identification of this suspicious activity, Darktrace’s Cyber AI Analyst™ also launched its own autonomous investigation into the connections. AI Analyst was able to recognize that these separate connections that took place over several days were, in fact, connected and likely represented command-and-control (C2) beaconing activity that had been taking place on the customer networks.

By analyzing the large number of external connections taking place on a customer’s network at any one time, AI Analyst is able to view seemingly isolated events as components of a wider incident, ensuring that customers maintain full visibility over their environments and any emerging malicious activity.

Figure 7: Cyber AI Analyst investigation detailing the SSL connectivity observed, including endpoint details and overall summary of the beaconing activity.

Conclusion

While Balada Injector’s tendency to interchange C2 infrastructure and utilize newly registered domains may have been able to bypass signature-based security measures, Darktrace’s anomaly-based approach enabled it to swiftly identify affected devices across multiple customer environments, without needing to update or retrain its models to keep pace with the evolving iterations of WordPress vulnerabilities.

Unlike traditional measures, Darktrace DETECT’s Self-Learning AI focusses on behavioral analysis, crucial for identifying emerging threats like those exploiting commonly used platforms such as WordPress. Rather than relying on historical threat intelligence or static indicators of compromise (IoC) lists, Darktrace identifies the subtle deviations in device behavior, such as unusual connections to newly registered domains, that are indicative of network compromise.

Darktrace’s suite of products, including DETECT+RESPOND, is uniquely positioned to proactively identify and contain network compromises from the onset, offering vital protection against disruptive cyber-attacks.

Credit to: Justin Torres, Cyber Analyst, Nahisha Nobregas, Senior Cyber Analyst

Appendices

Darktrace DETECT Model Coverage

Anomalous Server Activity / Anomalous External Activity from Critical Network Device
Anomalous Connection / Anomalous SSL without SNI to New External
Anomalous Connection / Rare External SSL Self-Signed
Compliance / Possible DNS Over HTTPS/TLS
Compliance / External Windows Communications
Compromise / Repeating Connections Over 4 Days
Compromise / Beaconing Activity To External Rare
Compromise / SSL Beaconing to Rare Destination
Compromise / HTTP Beaconing to Rare Destination
Compromise / Suspicious TLS Beaconing To Rare External
Compromise / Large DNS Volume for Suspicious Domain
Anomalous Server Activity / Outgoing from Server
Anomalous Server Activity / Rare External from Server
Device / Suspicious Domain

List of IoCs

IoC - Type - Description + Confidence

collect[.]getmygateway[.]com - Hostname - Balada C2 Endpoint

cdn[.]dataofpages[.]com - Hostname - Balada C2 Endpoint

stay[.]decentralappps[.]com - Hostname - Balada C2 Endpoint

get[.]promsmotion[.]com - Hostname - Balada C2 Endpoint

js[.]statisticscripts[.]com - Hostname - Balada C2 Endpoint

sleep[.]stratosbody[.]com - Hostname - Balada C2 Endpoint

trend[.]stablelightway[.]com - Hostname - Balada C2 Endpoint

cdn[.]specialtaskevents[.]com - Hostname - Balada C2 Endpoint

88.151.192[.]254 - IP Address - Balada C2 Endpoint

185.39.206[.]160 - IP Address - Balada C2 Endpoint

111.90.141[.]193 - IP Address - Balada C2 Endpoint

185.39.206[.]161 - IP Address - Balada C2 Endpoint

2.59.222[.]121 - IP Address - Balada C2 Endpoint

80.66.79[.]253 - IP Address - Balada C2 Endpoint

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) - User Agent - Observed User Agent in Balada C2 Connections

Gecko/20100101 Firefox/68.0 - User Agent - Observed User Agent in Balada C2 Connections

Mozilla/5.0 (Windows NT 10.0; Win64; x64) - User Agent - Observed User Agent in Balada C2 Connections

AppleWebKit/537.36 (KHTML, like Gecko) - User Agent - Observed User Agent in Balada C2 Connections

Chrome/117.0.0.0 - User Agent - Observed User Agent in Balada C2 Connections

Safari/537.36 - User Agent - Observed User Agent in Balada C2 Connections

Edge/117.0.2045.36 - User Agent - Observed User Agent in Balada C2 Connections

MITRE ATT&CK Mapping

Technique - Tactic - ID - Sub Technique

Exploit Public-Facing Application

INITIAL ACCESS

T1190

‍

Web Protocols

COMMAND AND CONTROL

T1071.001

T1071

‍

Protocol Tunneling

COMMAND AND CONTROL

T1572

‍

Default Accounts

DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS

T1078.001

T1078

‍

Domain Accounts

DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS

T1078.002

T1078

‍

External Remote Services

PERSISTENCE, INITIAL ACCESS

T1133

‍

Local Accounts

DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS

T1078.003

T1078

‍

Application Layer Protocol

COMMAND AND CONTROL

T1071

‍

Browser Extensions

PERSISTENCE

T1176

‍

Encrypted Channel

COMMAND AND CONTROL

T1573

‍

Fallback Channels

COMMAND AND CONTROL

T1008

‍

Multi-Stage Channels

COMMAND AND CONTROL

T1104

‍

Non-Standard Port

COMMAND AND CONTROL

T1571

‍

Supply Chain Compromise

INITIAL ACCESS ICS

T0862

‍

Commonly Used Port

COMMAND AND CONTROL ICS

T0885

References

[1] https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html

[2] https://blog.sucuri.net/2023/10/balada-injector-targets-unpatched-tagdiv-plugin-newspaper-theme-wordpress-admins.html

[3] https://securityboulevard.com/2021/05/wordpress-websites-redirecting-to-outlook-phishing-pages-travelinskydream-ga-track-lowerskyactive/

[4] https://thehackernews.com/2023/10/over-17000-wordpress-sites-compromised.html

[5] https://www.bleepingcomputer.com/news/security/over-17-000-wordpress-sites-hacked-in-balada-injector-attacks-last-month/

[6]https://nvd.nist.gov/vuln/detail/CVE-2023-3169

[7] https://www.geoedge.com/balda-injectors-2-0-evading-detection-gaining-persistence/

[8] https[:]//github[.]com/yifeikong/curl_cffi/blob/master/README.md

[9] https://www.virustotal.com/gui/domain/cdn.dataofpages.com

Written by

Justin Torres

Cyber Analyst

Inside the SOC

Written by

Justin Torres

Cyber Analyst

Senior Product Marketing Manager, Email

Watch the NIS2 Webinar

Blog

Email

December 18, 2025

Why organizations are moving to label-free, behavioral DLP for outbound email

Why outbound email DLP needs reinventing

In 2025, the global average cost of a data breach fell slightly — but remains substantial at USD 4.44 million (IBM Cost of a Data Breach Report 2025). The headline figure hides a painful reality: many of these breaches stem not from sophisticated hacks, but from simple human error: mis-sent emails, accidental forwarding, or replying with the wrong attachment. Because outbound email is a common channel for sensitive data leaving an organization, the risk posed by everyday mistakes is enormous.

In 2025, 53% of data breaches involved customer PII, making it the most commonly compromised asset (IBM Cost of a Data Breach Report 2025). This makes “protection at the moment of send” essential. A single unintended disclosure can trigger compliance violations, regulatory scrutiny, and erosion of customer trust –consequences that are disproportionate to the marginal human errors that cause them.

Traditional DLP has long attempted to mitigate these impacts, but it relies heavily on perfect labelling and rigid pattern-matching. In reality, data loss rarely presents itself as a neat, well-structured pattern waiting to be caught – it looks like everyday communication, just slightly out of context.

How data loss actually happens

Most data loss comes from frustratingly familiar scenarios. A mistyped name in auto-complete sends sensitive data to the wrong “Alex.” A user forwards a document to a personal Gmail account “just this once.” Someone shares an attachment with a new or unknown correspondent without realizing how sensitive it is.

Traditional, content-centric DLP rarely catches these moments. Labels are missing or wrong. Regexes break the moment the data shifts formats. And static rules can’t interpret the context that actually matters – the sender-recipient relationship, the communication history, or whether this behavior is typical for the user.

It’s the everyday mistakes that hurt the most. The classic example: the Friday 5:58 p.m. mis-send, when auto-complete selects Martin, a former contractor, instead of Marta in Finance.

What traditional DLP approaches offer (and where gaps remain)

Most email DLP today follows two patterns, each useful but incomplete.

Policy- and label-centric DLP works when labels are correct — but content is often unlabeled or mislabeled, and maintaining classification adds friction. Gaps appear exactly where users move fastest
Rule and signature-based approaches catch known patterns but miss nuance: human error, new workflows, and “unknown unknowns” that don’t match a rule

The takeaway: Protection must combine content + behavior + explainability at send time, without depending on perfect labels.

Your technology primer: The three pillars that make outbound DLP effective

1) Label-free (vs. data classification)

Protects all content, not just what’s labeled. Label-free analysis removes classification overhead and closes gaps from missing or incorrect tags. By evaluating content and context at send time, it also catches misdelivery and other payload-free errors.

No labeling burden; no regex/rule maintenance
Works when tags are missing, wrong, or stale
Detects misdirected sends even when labels look right

2) Behavioral (vs. rules, signatures, threat intelligence)

Understands user behavior, not just static patterns. Behavioral analysis learns what’s normal for each person, surfacing human error and subtle exfiltration that rules can’t. It also incorporates account signals and inbound intel, extending across email and Teams.

Flags risk without predefined rules or IOCs
Catches misdelivery, unusual contacts, personal forwards, odd timing/volume
Blends identity and inbound context across channels

3) Proprietary DSLM (vs. generic LLM)

Optimized for precise, fast, explainable on-send decisions. A DSLM understands email/DLP semantics, avoids generative risks, and stays auditable and privacy-controlled, delivering intelligence reliably without slowing mail flow.

Low-latency, on-send enforcement
Non-generative for predictable, explainable outcomes
Governed model with strong privacy and auditability

The Darktrace approach to DLP

Darktrace / EMAIL – DLP stops misdelivery and sensitive data loss at send time using hold/notify/justify/release actions. It blends behavioral insight with content understanding across 35+ PII categories, protecting both labeled and unlabeled data. Every action is paired with clear explainability: AI narratives show exactly why an email was flagged, supporting analysts and helping end-users learn. Deployment aligns cleanly with existing SOC workflows through mail-flow connectors and optional Microsoft Purview label ingestion, without forcing duplicate policy-building.

Deployment is simple: Microsoft 365 routes outbound mail to Darktrace for real-time, inline decisions without regex or rule-heavy setup.

A buyer’s checklist for DLP solutions

When choosing your DLP solution, you want to be sure that it can deliver precise, explainable protection at the moment it matters – on send – without operational drag.

To finish, we’ve compiled a handy list of questions you can ask before choosing an outbound DLP solution:

Can it operate label free when tags are missing or wrong? 
Does it truly learn per user behavior (no shortcuts)? 
Is there a domain specific model behind the content understanding (not a generic LLM)? 
Does it explain decisions to both analysts and end users? 
Will it integrate with your label program and SOC workflows rather than duplicate them?

For a deep dive into Darktrace’s DLP solution, check out the full solution brief.

[related-resource]

About the author

Carlos Gray

Senior Product Marketing Manager, Email

Blog

Email

December 17, 2025

Beyond MFA: Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace

What is an Adversary-in-the-middle (AiTM) attack?

Adversary-in-the-Middle (AiTM) attacks are a sophisticated technique often paired with phishing campaigns to steal user credentials. Unlike traditional phishing, which multi-factor authentication (MFA) increasingly mitigates, AiTM attacks leverage reverse proxy servers to intercept authentication tokens and session cookies. This allows attackers to bypass MFA entirely and hijack active sessions, stealthily maintaining access without repeated logins.

This blog examines a real-world incident detected during a Darktrace customer trial, highlighting how Darktrace / EMAIL^TM and Darktrace / IDENTITY^TM identified the emerging compromise in a customer’s email and software-as-a-service (SaaS) environment, tracked its progression, and could have intervened at critical moments to contain the threat had Darktrace’s Autonomous Response capability been enabled.

What does an AiTM attack look like?

Inbound phishing email

Attacks typically begin with a phishing email, often originating from the compromised account of a known contact like a vendor or business partner. These emails will often contain malicious links or attachments leading to fake login pages designed to spoof legitimate login platforms, like Microsoft 365, designed to harvest user credentials.

Proxy-based credential theft and session hijacking

When a user clicks on a malicious link, they are redirected through an attacker-controlled proxy that impersonates legitimate services. This proxy forwards login requests to Microsoft, making the login page appear legitimate. After the user successfully completes MFA, the attacker captures credentials and session tokens, enabling full account takeover without the need for reauthentication.

Follow-on attacks

Once inside, attackers will typically establish persistence through the creation of email rules or registering OAuth applications. From there, they often act on their objectives, exfiltrating sensitive data and launching additional business email compromise (BEC) campaigns. These campaigns can include fraudulent payment requests to external contacts or internal phishing designed to compromise more accounts and enable lateral movement across the organization.

Darktrace’s detection of an AiTM attack

At the end of September 2025, Darktrace detected one such example of an AiTM attack on the network of a customer trialling Darktrace / EMAIL and Darktrace / IDENTITY.

In this instance, the first indicator of compromise observed by Darktrace was the creation of a malicious email rule on one of the customer’s Office 365 accounts, suggesting the account had likely already been compromised before Darktrace was deployed for the trial.

Darktrace / IDENTITY observed the account creating a new email rule with a randomly generated name, likely to hide its presence from the legitimate account owner. The rule marked all inbound emails as read and deleted them, while ignoring any existing mail rules on the account. This rule was likely intended to conceal any replies to malicious emails the attacker had sent from the legitimate account owner and to facilitate further phishing attempts.

Figure 1: Darktrace’s detection of the anomalous email rule creation.

Internal and external phishing

Following the creation of the email rule, Darktrace / EMAIL observed a surge of suspicious activity on the user’s account. The account sent emails with subject lines referencing payment information to over 9,000 different external recipients within just one hour. Darktrace also identified that these emails contained a link to an unusual Google Drive endpoint, embedded in the text “download order and invoice”.

Figure 2: Darkrace’s detection of an unusual surge in outbound emails containing suspicious content, shortly following the creation of a new email rule.

Figure 3: Darktrace / EMAIL’s detection of the compromised account sending over 9,000 external phishing emails, containing an unusual Google Drive link.

As Darktrace / EMAIL flagged the message with the ‘Compromise Indicators’ tag (Figure 2), it would have been held automatically if the customer had enabled default Data Loss Prevention (DLP) Action Flows in their email environment, preventing any external phishing attempts.

Figure 4: Darktrace / EMAIL’s preview of the email sent by the offending account.

Darktrace analysis revealed that, after clicking the malicious link in the email, recipients would be redirected to a convincing landing page that closely mimicked the customer’s legitimate branding, including authentic imagery and logos, where prompted to download with a PDF named “invoice”.

Figure 5: Download and login prompts presented to recipients after following the malicious email link, shown here in safe view.

After clicking the “Download” button, users would be prompted to enter their company credentials on a page that was likely a credential-harvesting tool, designed to steal corporate login details and enable further compromise of SaaS and email accounts.

Darktrace’s Response

In this case, Darktrace’s Autonomous Response was not fully enabled across the customer’s email or SaaS environments, allowing the compromise to progress, as observed by Darktrace here.

Despite this, Darktrace / EMAIL’s successful detection of the malicious Google Drive link in the internal phishing emails prompted it to suggest ‘Lock Link’, as a recommended action for the customer’s security team to manually apply. This action would have automatically placed the malicious link behind a warning or screening page blocking users from visiting it.

Figure 6: Autonomous Response suggesting locking the malicious Google Drive link sent in internal phishing emails.

Furthermore, if active in the customer’s SaaS environment, Darktrace would likely have been able to mitigate the threat even earlier, at the point of the first unusual activity: the creation of a new email rule. Mitigative actions would have included forcing the user to log out, terminating any active sessions, and disabling the account.

Conclusion

AiTM attacks represent a significant evolution in credential theft techniques, enabling attackers to bypass MFA and hijack active sessions through reverse proxy infrastructure. In the real-world case we explored, Darktrace’s AI-driven detection identified multiple stages of the attack, from anomalous email rule creation to suspicious internal email activity, demonstrating how Autonomous Response could have contained the threat before escalation.

MFA is a critical security measure, but it is no longer a silver bullet. Attackers are increasingly targeting session tokens rather than passwords, exploiting trusted SaaS environments and internal communications to remain undetected. Behavioral AI provides a vital layer of defense by spotting subtle anomalies that traditional tools often miss

Security teams must move beyond static defenses and embrace adaptive, AI-driven solutions that can detect and respond in real time. Regularly review SaaS configurations, enforce conditional access policies, and deploy technologies that understand “normal” behavior to stop attackers before they succeed.

Credit to David Ison (Cyber Analyst), Bertille Pierron (Solutions Engineer), Ryan Traill (Analyst Content Lead)

Appendices

Models

SaaS / Anomalous New Email Rule

Tactic – Technique – Sub-Technique

Phishing - T1566

Adversary-in-the-Middle - T1557

About the author

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Balada Injector: Darktrace’s Investigation into the Malware Exploiting WordPress Vulnerabilities

Balada Injector: Darktrace’s Investigation into the Malware Exploiting WordPress Vulnerabilities

Introduction

What is Balada Injector?

Darktrace’s Coverage of Balada Injector

Conclusion

Appendices

List of IoCs

MITRE ATT&CK Mapping

References

Beyond MFA: Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace

Why organizations are moving to label-free, behavioral DLP for outbound email

Enjoying the blog?

More in this series

React2Shell: How Opportunist Attackers Exploited CVE-2025-55182 Within Hours

Atomic Stealer: Darktrace’s Investigation of a Growing macOS Threat

CastleLoader & CastleRAT: Behind TAG150’s Modular Malware Delivery System

Blog

Email

December 18, 2025

Why organizations are moving to label-free, behavioral DLP for outbound email

Why outbound email DLP needs reinventing

How data loss actually happens

What traditional DLP approaches offer (and where gaps remain)

Your technology primer: The three pillars that make outbound DLP effective

1) Label-free (vs. data classification)

2) Behavioral (vs. rules, signatures, threat intelligence)

3) Proprietary DSLM (vs. generic LLM)

The Darktrace approach to DLP

A buyer’s checklist for DLP solutions

Blog

Email

December 17, 2025

Beyond MFA: Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace

What is an Adversary-in-the-middle (AiTM) attack?

What does an AiTM attack look like?

Inbound phishing email

Proxy-based credential theft and session hijacking

Follow-on attacks

Darktrace’s detection of an AiTM attack

Internal and external phishing

Darktrace’s Response

Conclusion

Appendices

Models