Earth_Wendigo__2021__trendmicro.com-Earth_Wendigo_Injects_JavaScript_Backdoor_for_Mailbox_Exfiltration.pdf

Earth Wendigo is a targeted espionage campaign that has abused webmail XSS and Service Worker registration to implant JavaScript backdoors and establish WebSocket connections for automated mailbox exfiltration; victims include government, research, and university organizations in Taiwan and targeted activists. The report details infection/propagation techniques (spear-phishing, mail-signature poisoning, shortcut XSS), Service Worker credential theft, a WebSocket backdoor that issues get(URL) commands to read mail and attachments, additional Python-compiled Windows malware/shellcode loaders, and provides numerous IoCs (malicious domains and file hashes) and remediation guidance.