Report: online office suite Zoho's domains are being abused on a massive scale to exfiltrate data collected by malicious programs from compromised machines
The Indian online office suite is reportedly being abused on a massive scale to exfiltrate data from compromised machines.
Context & Ripple Effects
Zoho arrives at this report already managing an abuse problem on two fronts: it had just terminated service to the Daily Stormer, and registrar TierraNet pulled its DNS service offline amid the fallout. Now researchers say the suite's own domains are the exfiltration channel of choice for malware operators — the opposite failure mode, where legitimate infrastructure is weaponized rather than the customer base.
First-order effects
- Zoho inherits a policing burden its office-suite rivals largely avoid: distinguishing genuine document-sync traffic from stolen-data tunnels riding the same domains, or risk being blacklisted by network defenders.
Second-order effects
- Security teams respond by treating trusted SaaS domains as hostile-by-default, the same posture forced on Microsoft when a critical Word flaw powered a large-scale email malware campaign [[a:918070]] and again when Malwarebytes was breached through Azure and Office 365 [[a:1160391]] — eroding the 'legitimate domain = safe' assumption that makes these suites useful cover.
Third-order effects
- Governments betting on domestic suites inherit this exposure directly: India has since moved all 1.2M central-government employee addresses onto Zoho mail [[a:891335]], meaning the same infrastructure flagged as an exfiltration channel now carries state communications, and provider-level abuse monitoring becomes a national-security requirement rather than a product feature.
The trend: Attackers are increasingly hiding command-and-control and data theft inside mainstream productivity SaaS, pushing every suite vendor into a de facto threat-intelligence role over its own traffic.