Wolves in Windows Clothing: Weaponizing Trusted Services for Stealthy Malware

The talk starts from a common position: an attacker already has code running on a Windows machine and must still deliver payloads, control the host, move data out, avoid defenses, and persist. The speaker argues that much of this is routine engineering rather than exploitation, and that robotic process automation (RPA) products already handle it with components that endpoint tools trust by default. The RPA stack described has three parts: a local agent on each endpoint, a controller that receives work over outbound connections, and a cloud portal for management. The Power Automate agent ships with Windows 11.

The middle of the talk walks through enrolling a machine into an attacker-controlled cloud tenant, with a silent registration command that the speaker showed working without admin rights. Once enrolled, cloud-hosted flows can be queued to the machine and run in attended or unattended sessions, with results reported back. Demonstrations covered file exfiltration through the cloud channel, script execution, and no-code flows for file encryption, log cleanup, and browser token theft. A script that launched a known credential-dumping tool was flagged by endpoint protection, which pushed the work toward built-in no-code actions that avoided that detection.

The closing guidance focuses on detection and hardening. Defenders should watch the agent's command-line and PowerShell executables for unfamiliar tenant IDs, keep an inventory of the organization's own tenant IDs, and review registry-based settings. Older agent versions remain exposed without a formal CVE, and some organizations loosen the tenant restrictions, so business-built automations need governance. A companion open-source command-line tool was released so red teams can test these ideas.