OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society

Volexity documents a large, sophisticated OceanLotus (APT32) campaign that compromised over 100 strategic websites—primarily in Vietnam and nearby states—to deliver malicious JavaScript frameworks that profile visitors, selectively target whitelisted users with popups that phish Google OAuth consent, deploy webshells for persistence, and distribute custom backdoors and Cobalt Strike; the report includes detailed infrastructure indicators, detection signatures, and mitigation recommendations.