DragonForce backdoor requesting SkypeToken via Teams trap-exp/tokens endpoint with anomalous client signature

Arnold Chan@slaz

•updated 3 days ago•0•0•0

Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.