SMTP Exfiltration

Overview

Cross-family exfiltration technique: malware sends stolen data as email attachments or body text via hardcoded SMTP credentials. No dedicated C2 infrastructure required — the attacker only needs a disposable or compromised email account.

Typical Configuration

• SMTP server: often a cheap/shared hosting domain (e.g. mail.example.com, smtp.hostinger.com)
• Ports: 587 (STARTTLS), 465 (SSL/TLS), 25 (uncommon due to filtering)
• Authentication: plaintext username/password embedded in the binary
• Sender / Receiver: frequently the same address, or a dedicated drop address

Observed In

• agenttesla — mail.myhydropowered.com, sender versace@myhydropowered.com / password 0TFiRgPxmCJcdSB ^[/intel/analyses/accd2ccd2be48b4303154bb87f87d0d6897441c18ca7b16b22fbaa8b68bbacbb.html]
• remcos — RCData-encrypted SMTP config inside the PE resource
• vidar — Go infostealer with SMTP fallback alongside Telegram exfil

Advantages for Attackers

• SMTP traffic blends with legitimate business email flows
• No need to maintain a domain or VPS — any webmail account works
• Email providers rarely inspect attachments as aggressively as HTTP proxies

Detection Foci

• Unusual MAIL FROM / RCPT TO pairs from non-mail-client processes
• Large base64-encoded attachments in SMTP streams from svchost.exe or injected processes
• Hardcoded SMTP credentials in static strings (YARA / string match)

Related

• telegram-bot-exfiltration — alternative frictionless exfil channel
• ftp-exfiltration — older but still observed in some families