According to the recent Identity Exposure Report by SpyCloud, 87,000 credentials linked to Fortune 1000 C-level executives were recovered from the criminal underworld, in year 2022. Security leaders across organizations continue to live in constant terror of becoming a victim of a cyberattack and for good reason.
Cybercriminals can access networks and commit crimes including fraud, session hijacking, account takeover, and attacks with ransomware using exposed assets, such as usernames and passwords. Even though companies focus on enhancing their security tactics, like adding user authentication such as multifactor authentication and passkeys, criminals too put efforts into constantly being better in their crimes to bypass these high-end security barriers. One such method used commonly by threat actors includes using stolen active session cookies to commit session hijacking, which defeats the effectiveness of the conventionally employed safeguards.
In order to better their network defense and safeguard their customers, organizations and security experts must have a better understanding of the criminals’ methodologies to commit cybercrimes, like how they utilized stolen data for their profit.
Session Cookies
Session cookies are present all over the online space, from websites to applications that assign a cookie or token to identify their users. The series of characters used in the process is further stored on the device, making re-access easier for the user.
While this function provides personalized and smooth experience to users, this could be harmful if the data falls into the wrong hands. Using infostealer malware, cybercriminals can exfiltrate cookies and a variety of other data types from infected computers and implant them into browsers that cannot be easily detected, giving them the ability to pose as authentic users in a process known as session hijacking.
Impersonating as a legit user, a threat actor can thus freely navigate over the network committing fraud, helping a ransomware attack, stealing important company data, and more. No matter how the user signed in—using a username and password, a passkey, or by successfully completing the multifactor authentication (MFA) requirements—a session cookie will still confirm the user's identity.
Due to its difficult-to-detect nature, low cost of acquisition (normally available online for only a few dollars online/month), and regular success in stealing cookies and other recent, high-quality data has made infostealer quality soar.
Protecting Businesses and Their Customers
According to SpyCloud data, cookie theft by cyber thieves is already fairly frequent, with over 22 billion device and session cookie records seized by criminals last year. This entry point will expand because fraudsters are having great success accessing accounts and businesses via these cookies. For organizations trying to preserve their bottom line, having a strategy to proactively disrupt criminal operations is a vital requirement.
The recently developed malwares are difficult to be detected, considering their well-crafted designs. Common infostealers frequently leave little to no evidence of infection on the victim's device and exfiltrate sensitive data in a matter of seconds.
However, there are certain measures organizations can adopt in order to evade any risk from this malware as listed below:
- Educating employees about these threats has become crucial. Employees can alone reduce total malware exposure by identifying phishing attempts, exercising caution while using unmanaged or poorly maintained devices to access corporate systems and networks, not sharing passwords, and being aware of potentially harmful email attachments, websites, and downloads.
- The risk of session hijacking is decreased by removing "remember me" settings on platform login pages and regularly eliminating browser cookies, ensuring that thieves can't access active session cookies even in the event of malware infection.
- Security teams can obtain a comprehensive understanding of the compromised devices and data threatening their firms by using darknet data that has been ingested, vetted, and evaluated. Teams can invalidate open session cookies, reset the exposed application information, and patch any remaining vulnerabilities with this insight. By addressing the threat of stolen data before it escalates into a full-blown security issue, this strategy lessens the harm to enterprises.
