Virtual Private Keylogging: Cisco Web VPNs Leveraged for Access and Persistence

Volexity observed attackers modifying Cisco ASA Clientless SSL VPN (Web VPN) login pages—exploiting CVE-2014-3393 or via admin access—to inject JavaScript (xss.js, Scanbox) that captures credentials, session cookies, and keystrokes, enabling persistent network access; campaigns affected multiple sectors (medical, NGOs, academia, Japanese government, high-tech) and infrastructure overlaps link activity to PlugX-associated hosts.