FinalDraft Malware: The Stealthy Threat Using Microsoft Services

FinalDraft Malware is described as a cross‑platform threat, capable of infecting Windows and Linux systems, that hides in plain sight by exploiting Microsoft services to evade detection. The malware communicates with C2 servers via Microsoft Outlook’s Drafts folder, concealing encrypted messages within draft emails and using the Microsoft Graph API for authentication and communication.

Its loader, PathLoader, decrypts and executes shellcode to activate a backdoor that supports 37 commands, enabling actions such as file theft, process injection, and PowerShell execution without the actual PowerShell executable. It has been observed in attacks targeting government, telecommunications, finance, education, and healthcare sectors across South America, Southeast Asia, and beyond, with claims that well‑funded threat actors or nation‑states may be behind the operations.

The attackers blend into legitimate cloud services to evade traditional network detection, and the research highlights multiple MITRE ATT&CK techniques the malware leverages, including native API abuse, process injection, and script execution. For defences, the piece recommends multi‑layered protection, continuous monitoring of Outlook activity, and leveraging threat intelligence and dark web monitoring to identify FinalDraft‑related activity, underscoring the need for proactive incident response. 11 September 2025