Businesses are increasingly adopting security measures, from passkeys to multifactor authentication (MFA), to safeguard sensitive information and bolster their cybersecurity. However, it's crucial for security teams to acknowledge that these measures may not provide comprehensive protection for user data.
As enterprises implement new defenses to secure their networks, cybercriminals are simultaneously evolving their tactics to bypass these barriers. They are employing techniques like session hijacking and account takeover to circumvent passkeys and MFA, gaining unauthorized access to corporate systems. This is exacerbated by the fact that these tactics are largely facilitated by malware, which poses a significant challenge to security efforts.
Malware operates swiftly and discreetly, pilfering substantial amounts of accurate authentication data, including personally identifiable information (PII) such as login credentials, financial details, and authentication cookies. Some malware is even beginning to target local key vaults, like those managed by password managers, many of which have implemented passkey solutions. Last year, there were over 4 billion attempted malware attacks, making it the preferred method for cyberattacks. Moreover, SpyCloud's "2023 Annual Identity Exposure Report" revealed that more than 22 million unique devices fell victim to malware, with the stolen data finding its way to criminal networks for use in various attacks.
While malware-exfiltrated data, encompassing business application logins and cookies for crucial systems, is becoming increasingly valuable to criminals, security teams lack the necessary visibility to effectively counter these exposures. Those who comprehend how malware operates and how cybercriminals employ stolen data are better equipped to confront this threat.
Session hijacking commences when infostealer malware, often distributed through phishing emails or malicious websites, exfiltrates device and identity data. When a user logs into a site or application, a temporary authentication token (cookie) is stored in the browser.
Criminals can import this along with additional details to replicate the user's device and location, gaining access to an authenticated session. This technique is highly effective, even against robust authentication methods, allowing criminals to bypass authentication entirely. This grants them undetected access to sensitive information, enabling further data theft or privilege escalation for targeted attacks like ransomware.
Criminals recognize the potential of session hijacking and have developed tools like EvilProxy and Emotet to target authentication cookies. In the face of a threat that undermines key defenses, corporations must consider innovative approaches to combat cybercrime.
Overcoming the challenge of session hijacking is formidable but not insurmountable. The primary hurdle in defending against infostealer malware-fueled attacks is the malware's ability to avoid detection.
Newer forms of malware can swiftly siphon data and self-erase, making it challenging for security teams to even detect an attack. Furthermore, infostealer malware can infect personal and contractor devices beyond the usual scope of the security team's oversight, making it exceedingly difficult to identify all instances of exposure.
Fortunately, both of these concerns can be addressed through heightened threat awareness and visibility. Organizations must educate users on infostealers, how to avoid inadvertently downloading them onto devices accessing the corporate network or critical applications, and how to routinely clear cookies from their browsers.
In cases where malware manages to slip through defenses, understanding precisely what information was stolen is crucial. This allows teams to identify compromised user credentials and authentication cookies that require remediation. Simply wiping the infected device is insufficient, as stolen data can be exploited long after the initial infection is resolved. Organizations must pinpoint compromised data and take proactive steps, such as session invalidation and password resets, to sever potential entry points.
Ultimately, a comprehensive malware remediation process hinges on knowing what data was siphoned by infostealer malware. IT teams should prioritize solutions that offer enhanced visibility to address security gaps caused by malware. Armed with this knowledge, teams can take measures to safeguard all exposed assets, including authentication data, preserving the company's reputation and financial well-being.
