Shedding Light on Web Isolation Technologies and Their Bypass Techniques: C2 Communication via Outlook Using SMTP and IMAP

Web isolation products run browsing in a remote environment and send users only rendered images, so endpoints need little outbound HTTP or HTTPS. That makes the model attractive to banks and government bodies, but the speaker argues that email protocols are often left open. He reviews how malware families such as Ocean Map, which used IMAP, Agent Tesla, and Emotet have used email for command channels, data theft, and spam, and notes that most common C2 frameworks do not support IMAP or SMTP.

The core of the talk is a custom tool that drives Outlook through COM from PowerShell. The implant watches the inbox for commands, runs them locally, and returns results by email, so no direct connection to an attacker server is needed. In a demonstration, HTTP and HTTPS were blocked by the Windows host firewall and the channel still worked. The speaker also covers low traffic volume, Outlook's normal disk writes that make the activity blend in, and hiding commands inside images.

For defenders, the speaker suggests restricting programmatic access to Outlook, limiting email to approved domains where business needs allow, and using mail security filtering, while noting the tradeoffs of each. He mentions existing detection rules from Elastic, Splunk, and CrowdStrike, and a Sigma rule he wrote that flags outlook.exe started by the service host process with an embedding argument rather than by Explorer. The takeaway is that web-only egress controls leave mail protocols as a blind spot that needs monitoring.