An Attacker’s Blunder Gave Us a Look Into Their Operations

This report analyzes the day-to-day operations of a threat actor observed from May to July 2025: they performed targeted recon on financial and software firms, researched and probed Evilginx instances, used residential proxies and anti-detect browsers, accessed stolen cookie files, ran scripts to harvest Microsoft Entra tokens, and investigated dark web marketplaces and stealer logs—providing detailed TTPs, tooling, and browser/EDR artifacts for defenders.