Lumma: reviving Google sessions
Lumma Stealer profileIn 2023 Lumma announced that it could revive expired Google sessions; this showed that deleting the cookie alone might not be enough. Malpedia (Fraunhofer FKIE)
Capturing the cookie or token that represents a user’s open session and using it in the attacker’s browser.
After login, sites recognize the user by a session cookie. If this cookie is stolen, the attacker can continue the same session without being asked for a password or multi-factor authentication. MITRE ATT&CK
Because infostealers read browsers’ cookie databases, session hijacking is a common route to account takeover today. MITRE ATT&CK
The infostealer copies the browser’s cookie database. MITRE ATT&CK
The attacker loads the cookie into their own browser or an antidetect profile. MITRE ATT&CK
As long as the session is valid, the site takes the attacker for the user.
In 2023 Lumma announced that it could revive expired Google sessions; this showed that deleting the cookie alone might not be enough. Malpedia (Fraunhofer FKIE)
Stealerium-based malware also collects session tokens of services such as Steam, Minecraft, Battle.net and Uplay. Proofpoint
See your firm's attack surface on one screen: how many findings, at which severity, on which domain.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy