Overview: Disrupting the Infostealer Ecosystem with Decoy Cookies
Security researchers have developed an innovative method to observe and track the illicit operations of infostealer gangs. By creating ‘booby-trapped’ session cookies, a new application of Canarytokens, they have gained unprecedented visibility into the post-compromise lifecycle of stolen credentials. This research sheds light on how infostealers operate, from initial data validation to the sale of compromised access on underground forums, providing critical intelligence for defenders aiming to disrupt these criminal networks.
Will Frame, who operates the Restealer infostealer monitoring service, and Jacob Torrey, head of labs at Thinkst Applied Research, deliberately infected their own systems with infostealer malware. This strategic move allowed them to embed these decoy session cookies within the stolen data acquired by various infostealer operators. Their findings offer a unique glimpse into the economics and operational patterns of the infostealer supply chain, a common attack vector that leverages stolen data for further malicious activities, including bypassing multifactor authentication (MFA).
Technical Analysis: Tracking Infostealer Supply Chains and Post-Compromise Lifecycle
Session cookies are highly coveted by attackers because they allow bypass of MFA checks, granting direct access to accounts that have already undergone initial authentication. The researchers explained to iTnews that using session cookies is a common attacker tactic, especially when MFA is in play.
The research uncovered a distinct timeline for how stolen data is handled:
- Initial Delay: Following a system compromise, there is typically an approximately three-day window where no apparent activity occurs with the stolen data.
- Validation Checks: After this delay, initial checks are performed to verify the validity of the credentials and cookies. Frame suggests these checks are almost certainly conducted by ‘log providers’—the sellers—who are verifying the contents of their stolen logs before distributing them. This pre-screening allows them to identify high-value access, such as to corporate virtual machines or cloud portals like AWS/Azure, which can be sold separately at a premium or used for further internal investigations by the criminal groups.
- Increased Activity: Once validated and potentially sold, login attempts using the stolen credentials and cookies significantly increase, indicating the data has entered the broader criminal marketplace.
The infostealer trade itself is often subscription-based. Log providers pay for infostealer variants, distribute them via infected software or ‘ClickFix’ attacks, and then charge their own customers subscription fees for the collected data. Prices range widely, from as little as US$300 for lifetime access from newer providers to US$5,000-US$10,000 for larger operations. Logs typically contain a wealth of sensitive information beyond just session cookies, including passwords, browsing history, details of the infected machine, process trees, clipboard history, and payment/autofill data.
The challenge in measuring the scale of this trade lies in the shared and often manipulated data among cybercriminals, making deduplication difficult. Furthermore, Frame noted that many session cookies have a limited lifespan, potentially becoming invalid within hours or days of being stolen, highlighting the urgency for defenders.
Actionable Recommendations: Mitigating MFA Bypass via Stolen Session Cookies
For security professionals, understanding the infostealer supply chain is crucial for enhancing defense strategies. The insights from this research underscore several key actions:
- Implement Canarytokens: Consider deploying Canarytokens, including custom session cookie variants, within your own environment. Placing these ‘tripwires’ in sensitive locations can provide early warning of compromise. Other existing Canarytoken types mimic AWS API keys, Azure Entra ID logins, credit cards, and Office documents.
- Monitor for Compromised Credentials: Continuously monitor for leaked credentials and indications of stolen session cookies across dark web forums and intelligence feeds. Services like Restealer can assist in this effort.
- Expedite Credential Revocation: Upon detection of suspicious connections or leaked credentials, immediately revoke affected session cookies and force password resets. Given the short lifespan of many session cookies, rapid response is critical to prevent their exploitation.
- Enhance Endpoint Security: Strengthen endpoint detection and response (EDR) capabilities to prevent initial infostealer infections. Preventing the theft of session cookies at the source is the most effective defense.
- Educate Users: Implement ongoing user education programs to raise awareness about phishing, malvertising, and other vectors used to distribute infostealers.
By proactively detecting stolen session cookies post-compromise and understanding the attacker’s operational flow, organizations can significantly reduce the window of opportunity for attackers and mitigate the impact of infostealer campaigns.
Related: Human-Operated Phishing Steals AI Ad Account Credentials, Infostealers Target Anthropic Claude Users via Session Theft