Tool
office-cli
- First Reported
- Oct 8, 2026
- Latest Reported
- Oct 9, 2026
Reported Context (4)
- Data theft combines Curlc4.txt and office-cli email collection with DCSync credential harvesting through DC.exe. CISA Details How China-Linked Actors Steal Sensitive Data
- They also used the PHP script Curlc4.txt and command-line utility office-cli for email exfiltration, and DC.ex to extract sensitive data from Active Directory. US Disrupts Chinese State-Linked Hacking Tools Used Against Critical Infrastructure
- Cloud environments, and gain unauthorized access to mailbox data using a command-line utility known as office-cli. FBI Disrupts Flax Typhoon Tools Used to Target Critical Infrastructure
- A second tool, office-cli, keeps going back to Microsoft 365 accounts to take mail from different time periods. It works from configuration files that hold a client ID, tenant ID, and secret, and it avoids detection by FBI Says China-Linked Hackers Stole Emails and Gave Third Parties Access
Malware (3)
People (5)
Threat Actors (6)
MITRE ATT&CK (17)
Vendors (8)
Products (15)
Tools (17)
Industries (11)
Countries (6)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.