Virtual Private Keylogging: Cisco Web VPNs Leveraged for Access and Persistence
Summary: Volexity reported that attackers modified the login pages of Cisco Clientless SSL VPN portals on ASA devices to implant JavaScript that steals employee credentials at login, with its earliest known abuse traced to November 2014 through CVE-2014-3393. The campaign compromised organizations globally, including Japanese government and high-tech targets whose portals loaded the Scanbox profiling and keylogging framework, and Volexity shared information with JP-CERT in June 2015.
What's compelling: The backdoor sat on the VPN gateway itself, so the device employees trusted to reach internal resources became the credential collector, and the attackers used it to hold persistent access to victim networks.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Mentions
- CVE-2014-3393
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026