MS Exchange Server Flaws Exploited to Deploy Keylogger in Targeted Attacks

An unknown actor is exploiting patched ProxyShell flaws in Microsoft Exchange (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to inject a keylogger into logon.aspx that captures credentials to a web-accessible file; Positive Technologies identified over 30 victims across government, banking, IT and education in Africa and the Middle East and recommends updating Exchange and searching for injected clkLgn() code and the stolen-data file path.