Mustang Panda hijacks Zoho WorkDrive to spy on Indian government
China‑aligned Mustang Panda is running two espionage campaigns against Indian government and hydropower agencies, using the Zoho WorkDrive cloud service as a covert command‑and‑control channel. The group’s new ZOHOMURK tool hard‑codes Zoho OAuth tokens, letting it read commands and exfiltrate data through ordinary‑looking cloud traffic, exposing the danger of trusted SaaS platforms in supply‑chain attacks.