Session Token Hijacking, Infostealer Malware, ani Duniya Session Revocation¶

K’a ye ko binkannikɛla dɔ ye kriptowari nanbarakow bila dɔrɔn ka bɔ i ka YouTube, Instagram, Discord, walima X jatebɔsɛbɛn kɔnɔ, ka cikanw cicogo sariyaw da i ka Gmail walima Microsoft 365 inbox kɔnɔ, walima ka don i ka tɔn ka sankaba konsolɛ kɔnɔ k’a sɔrɔ i ma 2FA kode dɔ daminɛ abada i ka telefɔni na walima "New Login" email alert la, o ye Session Cookie / Token bolonɔbila ye min tɛ fili Hijacking (Pass-the-Cookie) min bɛ sɔrɔ Infostealer Malware fɛ. Ni i donna siti dɔ kɔnɔ ka "Keep me signed in" lajɛ, baarakɛla bɛ HTTP session cookie walima OAuth bearer token (i n’a fɔ Google ta) sirilen dɔ bɔ SID / . SAPISID, Microsoft ta ye ESTSAUTHPERSISTENT, walima Discord ta Authorization token) min maralen bɛ i ka ɛntɛrinɛti navigatɔrɔ ka sigida SQLite kunnafonidilan kɔnɔ.

Commodity infostealer malware denbayaw, i n’a fɔ Lumma Stealer, RedLine, Vidar, Raccoon, StealC, RisePro, Rhadamanthys, ani Atomic macOS Stealer (AMOS), olu kana kɔnɔnafili i ka ɔridinatɛri kɔnɔ i n’a fɔ laadala banakisɛw. Tuma caman na, a bɛ a yɛrɛ kɛ tulonkɛ mod nkalonma ye, porogaramuw sigibaga karilen, "ClickFix" PowerShell CAPTCHA ɲinini nkalonma, walima sponsor jɛ-ka-baara PDF, infostealer bɛ baara kɛ segin 4 kɔnɔ, k’i ka Chrome, Edge, Brave, walima Firefox decrypt Cookies ani Login Data kunnafonidilanw hakili la, k’u zipu ni i ka tabali kriptowari waribɔ filenw ye, ka sɛbɛnmarayɔrɔw bila Telegram walima C2 baarakɛminɛn dɔ kɔnɔ, ka a yɛrɛ bɔ. Ni binkannikɛla y’i ka session cookies sonyalenw don navigatɔrɔ dɔ kɔnɔ min bɛ se ka dɔnni kɛlɛ (Multilogin, . Dolphin{anty}, walima Gologin), ɛntɛrinɛti baarakɛla b’a miiri ko binkannikɛla ye i ka ɔridinatɛri ye min sɛgɛsɛgɛra kaban, k’i ka tɔgɔlasɛbɛn ni i ka dantigɛli kɛcogo fila bɛɛ tɛmɛn pewu.

--- .

Aw bɛ o kɛ sisan¶

1. I ka i ka tɔgɔlasɛbɛnw cili dabila ɔridinatɛri bananen kan, k’o PC walima Mac bɔ Wi-Fi la o yɔrɔnin bɛɛ, k’a ka Etɛrinɛti kabɔri bɔ. Nin ye fili #1 ye min bɛ kɛ mɔgɔ tɔɔrɔlenw fɛ: u b’a kɔlɔsi k’u ka Discord, Steam, walima Gmail minɛna, u bɛ sigi ɔridinatɛri tabali bananen kelen in na tigitigi, ka tɔgɔlasɛbɛn kuraw sɛbɛn Chrome kɔnɔ. Ni infostealer persistence loader walima baara bolodalen dɔ bɛ baara la hali bi o masin kan, o bɛna i ka tɔgɔlasɛbɛn kuraw ni session cookies kuraw minɛ o yɔrɔnin bɛɛ, k’u ci ka segin binkannikɛla ma. I ka tɔgɔlasɛbɛn caman cili ni i ka session revocations kɛmɛsarada la 100 kɛ ka bɔ smartphone saniyalen na (telefɔni selilɛri data kan walima Wi-Fi saniyalen kan) walima ɔridinatɛri danfaralen, min ma maga a la.
2. A faamuya ko ni i ye tɔgɔlasɛbɛn caman cili dɔrɔn, o TƐ tuma bɛɛ ka session cookies sonyalenw walima OAuth refresh tokens tiɲɛ tuma bɛɛ, i WAJABA ka "Sign Out of All Sessions" digi k'a jɛya ANI ka mɔgɔ sabananw ka OAuth apps bɔ yen. Plateforme caman kan (ani ni Google ka sɛbɛnw tɛ MultiLogin / . issueToken OAuth labanyɔrɔw walima session tokens minnu bɛ mɛn), n’i y’i ka tɔgɔlasɛbɛn Changer dɔrɔn walima ka 2FA wuli, o bɛ se ka session secondaire tokens walima OAuth desktop tokens minnu bɛ yen, olu to ɲɛnamaya la fo n’i ye plateforme kɛrɛnkɛrɛnnenw Global Session & Token Revocation taamasiyɛnw kɛ ja in kɔnɔ.
3. Ni i ye porogaramu kriptowari waribɔlan dɔ faranfasi (MetaMask, Phantom, Rabby, Trust Wallet, Coinbase Wallet, Exodus, Electrum) bila ɔridinatɛri bananen kan, i ka telefɔni saniyalen kɛ sisan yɛrɛ walasa k’i ka nafolo labɔ ka taa fɛnɲɛnamafagalanw ka waribɔsɛbɛn kisɛ kumasen kura kɔnɔ. Infostealer logs bɛ otomatiki ka vault files encryptés (Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn for MetaMask) kɛrɛfɛ i ka navigatɛri ka tɔgɔlasɛbɛn maralenw. Hali ni binkannikɛla ma maga i ka kripto la fɔlɔ, i ka vault file sigilen bɛ dibi sugu dɔ kan kaban ka GPU cracker makɔnɔ min tɛ ɛntɛrinɛti kan. Executer an ka kriptowari portefeuille drain ani kisɛ kumasen bɛnkan ɲɛminɛni teliya la.
4. I ka "Apex Identity Accounts" (Email fɔlɔ, Password Manager, Apple/Google Account, ani Corporate SSO) lakana miniti 10 fɔlɔ kɔnɔ. I ka smartfon saniyalen kan, i ka Google / Gmail fɔlɔ da wuli (myaccount.google.com/device-activity) ani Microsoft ( ) .mysignins.microsoft.com) jatew fɔlɔ. I ka bɔ tabali lajɛw bɛɛ la, ka tɔgɔlasɛbɛnba wuli, ka Settings > Forwarding and POP/IMAP ani Filters/Rules lajɛ walasa ka binkannikɛla ye imayili cicogo dogolen sariya dogolenw bɔ yen walasa ka tɔgɔlasɛbɛnw dogo ka bɔ baarakɛyɔrɔ wɛrɛw la, ani ka Passkeys and Authenticator minɛnw lajɛ minnu tɔgɔ sɛbɛnna.
5. Aw ka Windows Registry lajɛ Run keys, Task Scheduler, ani PowerShell tariku ni i ye "ClickFix" nkalontigɛ CAPTCHA cikan dɔ boli kɔsa in na (Win + R -> Ctrl + V). Infostealer vektɔri minnu bɛ ka bonya teliya la bi, olu dɔ ye Cloudflare walima Google CAPTCHA popup nkalonma ye ɛntɛrinɛti yɔrɔ dɔ kan min b’i bila ka "Press Win + R, sɛbɛnnikɛlan Ctrl + V, ani ka digi Enter ka a sɛgɛsɛgɛ ko i ye hadamaden ye" (min bɛ dogolen dɔ kɛ ni makun ye mshta.exe walima powershell -w hidden -enc ... cikan min bɛ kopi kɛ i ka clipboard kɔnɔ).
6. I ka hakilina mara ani ka farikolo lakanani lakana ni sariya tiɲɛni in bɛ tali kɛ jɛkulu ka fɛnsɔrɔsiraw walima wari ɲinini na. Infostealer ka sɛbɛnw bɛ to ka kunmabɔnafolo walima cɛnimusoya imɛli otomatikiw lawuli minnu bɛ i ka tɔgɔlasɛbɛn sonyalen fɔ. Aw kana wari ɲinibagaw sara abada; aw ye anw lajɛ cɛnimusoya ni mɔgɔw bilali ɲɔgɔn na ɛntɛrinɛti kan ɲɛminɛbaga, ani ni i ye bagabagali dɔ sɔrɔ farikolo la don dɔ, i bɛ i ka sigida kɔrɔtɔko nimɔrɔ wele (911 Ameriki ni Kanada, 112 Erɔpu tɔnba bɛɛ kɔnɔ, 999 Angletɛri, walima an ka kɔrɔtɔko nimɔrɔw ɲɛbilasɛbɛn).

--- .

Infostealer & session cookie hijacking ko kɛlen jaabi latigɛ jiri¶

flowchart TD
    Root["Siga bɛ Session Cookie Hijacking walima Infostealer Malware banakisɛ sɔrɔli la"] --> IsolatePC["ƝƐFƆLI 1: Aw bɛ PC/Mac banakisɛ bɛ min na, aw bɛ o tigɛ joona ka bɔ Wi-Fi & Ethernet la (Aw kana tɔgɔlasɛbɛnw Changer PC bananen kan)"]

    IsolatePC --> CryptoCheck{"Yala Crypto Wallet Extensions (MetaMask, Phantom, Exodus) dɔw tun bɛ o PC kan wa?"}
    CryptoCheck -->|"Ɔwɔ"| EvacCrypto["Baara kɛ ni Telefɔni/Hardware Portefeuille saniyalen ye o yɔrɔnin bɛɛ walasa ka Crypto Assets bɛɛ Labɔ ka Kɛ Kisɛ Kumasen kura ye"]
    CryptoCheck -->|"Ayi"| ApexLock["2nan : Telefɔni seleke naani saniyalen kan, i ka Email fɔlɔ (Gmail, Outlook, Proton) Dabɔ fɔlɔ"]
    EvacCrypto --> ApexLock

    ApexLock --> GlobalRevoke["3NAN : Ka Duniya Session + OAuth Token + Passkey Revocation kɛ Jatebla kɔrɔlenw bɛɛ kɔnɔ (Aw ye Plateforme Matrix lajɛ jukɔrɔ)"]

    GlobalRevoke --> ExportList["4NAN: PC min bananen don ni ɛntɛrinɛti tɛ, i ka Navigatɛri ka tɔgɔlasɛbɛnw & Cookies maralenw bɛɛ lisɛli bɔ kɛnɛ kan walasa k’a dɔn tigitigi jatebɔsɛbɛn minnu sonyalen don"]

    ExportList --> CleanOS["5NAN: Mɔgɔ yɛrɛ ka sɛbɛnw dɔrɔn de kɔpi -> Clean OS Wipe/Reinstall kɛ -> Segin ka Passkeys tɔgɔ sɛbɛn & Enable Chrome App-Bound Encryption"]

--- .

Infostealers bɛ 2FA ni DPAPI / Keychain encryption tɛmɛ cogo min na, o faamuyali¶

Kilobayiti 200 porogaramu bɛ se ka daɲɛ dogolenw ni session cookies sonya cogo di, Google Chrome, Microsoft Edge ani Brave bɛ minnu siri i ka disque dur kɔnɔ?

1. Windows DPAPI (CryptUnprotectData) ani Chrome App-Bound Encryption (v20):
2. Windows kan, Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi) b’i ka tɔgɔlasɛbɛn maralenw mara u kɔnɔ %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data ani i ka session cookies kɔnɔ \Network\Cookies.
3. O SQLite kunnafonidilanw bɛ siri ni AES-256-GCM master key ye min maralen bɛ %LOCALAPPDATA%\Google\Chrome\User Data\Local State, min lakananen don Windows Data Protection API (DPAPI) fɛ min sirilen bɛ i ka Windows baarakɛla ka jatebɔsɛbɛn kɔnɔ min donna.
4. Ikomi i ye infostealer boli i n’a fɔ i yɛrɛ ka Windows baarakɛla donna, baara o baara bɛ kɛ i ka baarakɛla ka jatebɔsɛbɛn kɔnɔ, o bɛ se ka wele tariku kɔnɔ CryptUnprotectData() ka Windows ɲininka a ka kilisi in decrypt. Ani ka tɛmɛn Chrome 127+ App-Bound Encryption (v20 ascenseur service), bi infostealers bɛ pikiri kɛ ka ɲɛsin kunkolo tɛ min na chrome.exe debugging taabolo (--remote-debugging-port) walima ka baara kɛ ni COM elevation ye walasa k’a ɲini Chrome yɛrɛ fɛ a ka cookie ɲɛnamaw bɛɛ fili.
5. macOS Keychain & Atomique macOS Sonyalikɛla (AMOS / PoseStealer):
6. Apple macOS kan, infostealers ye u yɛrɛ kɛ i n’a fɔ .dmg telesarsew (a ka c’a la, a b’a ɲini i fɛ i ka "I kininbolo digi -> Da wuli" walima i ka taamasiyɛn sama ka taa Terminal la walasa ka Apple Gatekeeper tɛmɛ) bɛ macOS native dialog box nkalonma dɔ bɔ min bɛ kalan "System Preferences b'a fɛ ka se i ka gundo kunnafoni sɔrɔ: I ka Mac doncogo tɔgɔ sɛbɛn". I y’i ka Mac doncogo tɔgɔ sɛbɛn o yɔrɔnin bɛɛ la o ɲininikɛlan kɔnɔ, script bɛ da wuli -/Library/Keychains/login.keychain-db ani ka Safari/Chrome cookies, Apple Notes ani iCloud tokenw kopi kɛ.
7. Google (Google) ye MultiLogin / . OAuthLogin Token Regeneration Exploit: Bamako, Mali.
8. Lakanali ɲininikɛlaw y’a jira ko kunnafoni sonyabagaw tɛ ɛntɛrinɛti cookie standardw sonya dɔrɔn, u bɛ sɛbɛnw fana bɔ minnu tɛ sɛbɛn sɔrɔ ** .oauth_token baarakɛyɔrɔ tokenw** ka bɔ Chrome ka ** .Web Data (token_service tabali)** SQLite filen. Hali ni jatigɛwalekɛla dɔ y’a ka Google tɔgɔlasɛbɛn Changé siɲɛ kelen, binkannikɛlaw tun bɛ se ka sonyalen in tulon kɛ kokura ka kɔn o ɲɛ token_service OAuth token ka Google kɔnɔna na OAuthLogin labanyɔrɔ ka mint brand-new valid SID browser cookies fo ni baarakɛla y’a jira k’a jɛya ko a ye Chrome minɛnw ka sigida tiɲɛnen bɔ ANI ka mɔgɔ sabanan/OAuth minɛnw doncogo ban.

--- .

1nan : Duniya Session, Cookie, OAuth ani Passkey Revocation Matrix¶

Baara kɛ ni smartphone saniyalen ye walima ɔridinatɛri filanan saniyalen ye, ka baara kɛ ka jigin nin tabali tigitigi in na k’a ta sanfɛ ka taa duguma. Order matters: tuma bɛɛ ka Step A (Sign out all active sessions/devices) ani Step B (Change password) ani Step C (Audit 2FA/Passkeys/OAuth/Forwarding) kɛ ɲɔgɔn fɛ, n’i y’i ka password Changer dɔrɔn k’a sɔrɔ i ma sessions actives ban, binkannikɛla ka navigatɔrɔ ɲɛnama tab bɛ to don kɔnɔ ani a bɛ se k’i kɔlɔsi walima fara a kan ka segin-ka-bɔnye fɛɛrɛ jugu dɔ fara a kan.

--- .

2nan : Jatebɔsɛbɛn BƐƐ min bɔra kɛnɛ kan i ka ɔridinatɛri banakisɛ bɛ min na, i bɛ se k’o dɔn cogo min na¶

I kɛlen kɔ k’i ka jatebɔsɛbɛn 10 kɔrɔlenw datugu i ka telefɔni saniyalen kan, i bɛ ɲininkali gɛlɛn dɔ sɔrɔ: "Ne ye baara kɛ n’o ɔridinatɛri ye kabini san naani, ne b’a dɔn cogo di ko ne ka siti 250 la jumɛn tun ye tɔgɔlasɛbɛnw walima cookies baarakɛtaw mara Chrome/Edge kɔnɔ tuma min na infostealer bolila?

Ni aw bɛ ɔridinatɛri banakisɛ bɛ min na kɛmɛsarada la, a tɛ ɛntɛrinɛti kan (Wi-Fi OFF, Ethernet unplugged), aw bɛ a da ani ka aw ka fɛnw jiracogo tigitigi bɔ sani aw ka masin ko:

1. I ka Browser Saved Passwords List (CSV):
2. I ka navigatɛri da wuli ka bɔ ɛntɛrinɛti kan (chrome://password-manager/settings Chrome kɔnɔ, edge://wallet/settings ka Edge, walima about:logins Firefox kɔnɔ) ani ka Export passwords digi walasa ka a mara Chrome Passwords.csv ka don USB flash drive saniyalen dɔ kan.
3. Mun na nin dosiye in ye sanu ye i ka segin-ka-bɔnye kama: Infostealer ye nin database tigitigi in sonya. Ka kɛ ni Chrome Passwords.csv min bɛ i ɲɛfɛ, o bɛ websayiti kelen-kelen bɛɛ tɔgɔ ni tɔgɔlasɛbɛn tigitigi di i ma, binkannikɛla bɛ min bolo sisan, walasa i kana ɲinɛ impositi dakun kɔrɔ dɔ kɔ, awiyɔn kilomɛtɛrɛ jatebɔsɛbɛn dɔ kɔ, walima sannikɛyɔrɔ dɔ la ni karti maralen ye.
4. A lajɛ site web minnu tun bɛ ni Session Cookies baarakɛtaw ye (chrome://settings/content/all):
5. Chrome walima Edge kɔnɔ (k’a sɔrɔ i tɛ ɛntɛrinɛti kan), taa ** .chrome://settings/content/all** (walima edge://settings/content/all) ani ka u labɛn ka kɛɲɛ ni Data maralenw walima Mɔgɔ caman lajɛra ye. I tora ka don site web o site web kɔnɔ k’a sɔrɔ i ma tɔgɔlasɛbɛn sɛbɛn, o tun bɛ se ka kɛ session cookie sonya ye, wa a ka kan k’a ka session ban.
6. A lajɛ ni i ka Standalone Password Manager (1Password, Bitwarden, KeePassXC) dabɔra banakisɛ sɔrɔli waati la:
7. Ni i ka 1Password, Bitwarden, walima KeePassXC vault tun LOCKED tuma min na infostealer bolila: Malware tun bɛ se ka sigida vault cache encrypté dɔrɔn de minɛ (data.json walima .kdbx), min lakananen don PBKDF2-SHA256 / Argon2id + i ka Master Password fɛ (ani Secret Key min bɛ kɛ ni sɛbɛnni 34 ye 1Password kɔnɔ). Ni i ka Master Password barika ka bon, i ka vault kɔnɔkow bɛ to lakana la, hali ni i ka kan ka i ka Master Password wuli hali bi k’i yɛrɛ tanga.
8. Ni i ka password manager browser extension tun UNLOCKED in memory tuma min na porogaramu jugu in bolila (walima n’i y’i ka Password Manager Master Password mara Chrome ka autofill kɔnɔ min bɛ a kɔnɔ.): I k’a miiri ko infostealer y’i ka vault fili walima k’i ka Master Password minɛ, ani ka seereyaw kɔrɔlenw bɛɛ wuli i ka vault kɔnɔ.

--- .

3nan : Infostealer ka timinandiya ɲinini n’a ban sani ka OS ko¶

Sani i k’i yɛrɛ ka sɛbɛnw labɛn ani ka OS seginni saniyalen kɛ, i bɛ se k’a lajɛ infostealer donna i ka sistɛmu kɔnɔ cogo min na ani n’a ye donikɛla filanan min bɛ to senna (i n’a fɔ Scheduled Task, Registry) fili Run key, Daminɛ .lnk sira surun, walima Chrome Extension jugu):

1. Aw bɛ nin PowerShell Persistence Audit (Windows) in kɛ min tɛ ɛntɛrinɛti kan .¶

PowerShell (Admin) da wuli PC kan min tɛ ɛntɛrinɛti kan ani ka nin kiritigɛlaw ka sɛgɛsɛgɛli naani kɛ minnu bɛ kalan dɔrɔn:

# 1. Check the Windows Run/RunOnce Registry Keys for user-level malware loaders in AppData/Temp:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                       "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
                       "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue

# 2. Check the Startup Folder for suspicious .lnk, .vbs, .bat, or .exe files:
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
                    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force

# 3. List all Scheduled Tasks created or modified in the last 7 days calling PowerShell, cmd, mshta, or AppData:
Get-ScheduledTask | Where-Object { $_.State -ne "Disabled" } | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    foreach ($action in $_.Actions) {
        if ($action.Execute -match "powershell|cmd|mshta|wscript|cscript|rundll32|regsvr32|AppData|Temp|ProgramData") {
            [PSCustomObject]@{
                TaskName = $_.TaskName
                Execute  = $action.Execute
                Args     = $action.Arguments
                LastRun  = $info.LastRunTime
            }
        }
    }
} | Format-Table -AutoSize

# 4. Check Windows Defender Exclusions (Infostealers immediately add C:\ or AppData to Defender Exclusions.):
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath | ForEach-Object { Remove-MpPreference -ExclusionPath $_ }

2. Mun na OS saniyalen seginni (USB Media fɛ) ka ɲi Infostealer kɔfɛ¶

Ni Microsoft Defender Offline Scan ani Malwarebytes bɛ baara kɛ Defender bɔli kɔfɛ, o bɛ persistence loaders dɔntaw bɔ yen, jagofɛnw kunnafoni sonyabagaw bɛ to ka RAT (Remote Access Trojan), SystemBC SOCKS5 proxy filanan, walima clipper malware (min bɛ i ka Windows clipboard ni swap kɔlɔsi ni makun ye Bitcoin/Ethereum waribɔlan ladɛrɛsi o ladɛrɛsi kopilen ni hakɛri ka ladɛrɛsi ye). - Ni i ye i yɛrɛ ka sɛbɛnw, fotow, ani... Chrome Passwords.csv ka bɔ PC la min tɛ ɛntɛrinɛti kan, i ka Windows 11 USB Reinstall (walima macOS Erase All Content and Settings) saniyalen kɛ ka tugu an kɔ malware, ransomware ani spyware banakisɛw sɔrɔcogo gafe.

3. macOS ni Linux sitɛmuw jateminɛni Infostealer fɛn dilannenw kama (Atomic macOS Stealer / AMOS, . Poseidon, ani Navigatɛri jugumanw)¶

Ni i ka masin min bananen don, o ye Apple MacBook/iMac ye walima Linux developpeur baarakɛyɔrɔ ye sanni ka kɛ Windows PC ye, i ka nin terminali sɛgɛsɛgɛliw kɛ minnu tɛ ɛntɛrinɛti kan walasa ka persistencew dɔn ani k’u ban:

# On Apple macOS:
# 1. Check for unauthorized LaunchAgents and LaunchDaemons dropped by AMOS / Poseidon Stealer:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

# 2. Check for hidden staging folders in /tmp or /var/folders created by AppleScript / osascript stealers:
find /tmp /var/folders -iname "*out.zip*" -o -iname "*passwords.txt*" -o -iname "*cookies*" 2>/dev/null

# 3. Inspect installed Chrome / Brave / Edge Extensions for rogue manifest permissions ('cookies', 'webRequest', '<all_urls>'):
grep -rn '"permissions"' ~/Library/Application\ Support/Google/Chrome/Default/Extensions/ 2>/dev/null

4. Baarakɛda ni sankaba ɲɛmɔgɔw ka baarakɛminɛnw (Microsoft Entra ID, Okta, Google Workspace, ani AWS IAM) .¶

Ni kunnafoni sonyala dɔ ye ɔridinatɛri min sɔrɔ, o tun ye porogaramu injiniyɛri dɔ ta ye, DevOps ɲɛmɔgɔ dɔ, walima tɔn baarakɛla dɔ ta min tun bɛ ni sessions actives ye Microsoft Entra ID (Azure AD), Okta, Google Workspace, AWS, walima Cloudflare kɔnɔ, sigida minɛnw saniya ye kɛlɛ tilancɛ dɔrɔn ye. Aw bɛ nin sankaba ɲɛbilasɛbɛnw bɔli kɛ o yɔrɔnin bɛɛ:

• Microsoft ka donko ID (Revoke-MgUserSignInSession): Ni i ye "Sign out" digi navigatɛri kelen kɔnɔ, o tɛ Primary Refresh Tokens (PRTs) walima Azure CLI (az login / . .azure/msal_token_cache.bin) token minnu kopilen don ka bɔ disiki la. Entra Administrateur dɔ ka kan ka boli Revoke-MgUserSignInSession -UserId user@company.com Microsoft Graph PowerShell kɔnɔ walasa ka baarakɛla ta lasegin signInSessionsValidFromDateTime attribute ani ka Refresh Tokens bɛɛ tiɲɛ labanyɔrɔ bɛɛ la waati kelen na.
• AWS CLI & Developpeur Token jiginni (-/.aws/credentials, . -/.npmrc, . -/.pypirc, . -/.kube/config): Jagofɛnw kunnafoni sonyabagaw bɛ baarakɛla bɛɛ ka so ɲɛbilasɛbɛn sɛgɛsɛgɛ k’a jɛya .aws/credentials, . .ssh/id_ed25519, . .gitconfig, . .env, ani Docker/Kubernetes labɛncogo filenw. O yɔrɔnin bɛɛ la, AWS IAM Access Keys (AKIA...) AWS Console kɔnɔ, GitHub Personal Access Tokens (ghp_...), ani ka SSH foroba kilisi jiralenw bɔ sɛnɛfɛnw dilanni baarakɛminɛnw na (-/.ssh/authorized_keys).
• Tabali cikan & VPN Client Token Purge (Telegram Bureau tdata, Signal, Slack, OpenVPN, WireGuard): Web navigatɔrɔw kɔfɛ, infostealer modulew bɛ kɛrɛnkɛrɛnnenya la kopi kɛ %APPDATA%\Telegram Desktop\tdata ɲɛbilasɛbɛn (min b’a to binkannikɛla bɛ se k’i ka Telegram jatebɔsɛbɛn bɛɛ kɛ u ka ɔridinatɛri kɔnɔ k’a sɔrɔ a ma SMS kode sɔrɔ), %APPDATA%\Slack\storage, ka mara OpenVPN (.ovpn) / WireGuard (.conf) jɛkulu ka VPN ɲɛfɔli sɛbɛnw. Telegramu da wuli i ka telefɔni na (Settings > Devices -> Terminate All Other Sessions), i ka bɔ Slack baarakɛyɔrɔw bɛɛ la (slack.com/account/settings -> Sign out all other sessions), ani k’a ɲini i ka réseau administrateur fɛ a ka i ka corporate VPN client certificate bɔ yen ani k’a di kokura.

--- .

Bana kunbɛncogo: I bɛ se ka i ka navigatɛri ni i ka jatew kɛ cogo min na, u ka se ka Infostealers kɛlɛ¶

Ni i ka sitɛmu saniyalen don ani ni i ka jatew seginna, i ka nin lafasali duuru ninnu waleya walasa kunnafoni sonyabaga kana se k’i ka ɲɛnamaya nimɔrɔma minɛ tugun abada:

• AW kana daɲɛ dogolenw mara abada i ka ɛntɛrinɛti-navigatɛri ka daɲɛ-sɛbɛnni-minɛn kɔnɔ (Chrome / Edge / Brave / Firefox Autofill) ni Hardware/Master Key tɛ i la: Dugukolo kan jagofɛn kunnafoni sonyabaga bɛɛ bɛ Chrome ta laɲini Login Data SQLite tabali fɔlɔ. OFF "Offer to save passwords" don chrome://password-manager/settings ani k’i ka tɔgɔlasɛbɛnw mara daɲɛ dogolenw ɲɛnabɔbaga kɛrɛnkɛrɛnnen dɔ kɔnɔ, min tɛ dɔnniya zeru ye (1Password, Bitwarden, Proton Pass, walima KeePassXC) min labɛnna ka Auto-Lock teliya la ni sistɛmu bɛ datugu walima miniti 5 baarakɛbali kɔfɛ.
• Ka "Device-Bound Session Credentials (DBSC)" & "App-Bound Encryption" kɛ Chrome 127+ kɔnɔ: Aw ye aw jija Google Chrome walima Edge ka ladamu ka kɛɲɛ ni a bɔko laban ye ani ka a bila sistɛmu ɲɛbilasɛbɛn kɔnɔ (C:\Program Files\Google\Chrome\Application) o la GoogleChromeElevationService bɛ se ka kuki sirili siri sistɛmu ka josariyaw hakɛw la ani TPM fɛnɲɛnamafagalanw kilisi la Device-Bound Session Credentials (DBSC) fɛ.
• Windows Run Box (Win + R) walima mshta.exe ka "ClickFix" Fake CAPTCHA Attacks bali**: Aw kana ** digi abada .Win + R -> Ctrl + V -> Enter** ni siti dɔ CAPTCHA, Cloudflare ekran nkalonma, walima "Fix Microphone / Fix Font" pop-up b'a ɲini i fɛ i ka cikan dɔ nɔrɔ i ka Run dialogue walima Terminal kɔnɔ, siti sariyalen si tɛ Dugukolo kan min tɛ hadamadenya sɛgɛsɛgɛ abada n'a y'a ɲini i fɛ i ka kode nɔrɔ a kɔnɔ Win + R walima macOS Terminal ye.
• Baara kɛ ni Hardware Security Keys (YubiKey) walima Passkeys + Require Re-Authentication for Sensitive Actions: K’a sɔrɔ session cookies sonyalenw bɛ don fɔlɔ ɲininiw tɛmɛ, plateforme belebelebaw (Google, GitHub, Cloudflare, AWS, AWS, Coinbase) bɛ Step-Up Authentication (Sudo Mode) wajibiya min bɛ FIDO2 YubiKe tap farikoloma wajibiya walima Passkey biometric check sanni i ka sira di mɔgɔ o mɔgɔ ma min bɛ ni session cookie ye, o ka se k’i ka password Changer, ka dataw bila jamana wɛrɛw la, walima ka bɔli ladɛrɛsi dɔ fara a kan.
• A lajɛ ni i ka email walima sonyali sɛbɛn bɔra Darknet Monitoring Databases kan: Visit haveibeenpwned.com (min bɛ sonyalikɛlaw ka jatebɔsɛbɛn miliyɔn caman ka imeyilɛriw ni domaines compromises index kɛ sisan) ani ka dibi ladɛrɛsi tiɲɛni kunnafoniw di fu i ka imeyilɛriw la.
• Téléchargements, game mods, ani mɔgɔ wɛrɛw ka scripts minnu tɛ da i la, olu faranfasi Virtual Machine walima Windows Sandbox kɔnɔ: Aw kana baara kɛ abada ni sɛgɛsɛgɛli tɛ .exe, . .msi, . .dmg, . .bat, walima Python pip / Node (Node) ye npm post-install scripts k’a ɲɛsin host operating system ma min b’i ka web browser sessions lakikaw ni wariko dontaw mara. Windows Sandbox (a jɔlen bɛ Windows 10/11 Pro ani Enterprise kɔnɔ Turn Windows features on or off > Windows Sandbox) daminɛ walima ka baara kɛ ni masin virtuel ye min bɛ a dan na ni browser cookies maralen zeru ye ni i bɛ mɔgɔ wɛrɛw ka baarakɛminɛnw kɔrɔbɔ.

--- .

Ɲininkali minnu bɛ kɛ tuma caman na¶

--- .

Gafe minnu bɛ tali kɛ o ko la¶

• Malware, ransomware ani spyware banakisɛw
• MFA phishing ani Adversary-in-the-Middle (AiTM) ka tɛmɛn
• MFA lockout: cogo min na ka jatedenw sɔrɔ minnu datugulen don
• Email account hacked, forwarding sariyaw, ani a seginni
• Cryptocurrency portefeuille drain ani kisɛ kumasen bɛnkan
• Password manager lockout ani kɔrɔtɔko vault seginni
• Kɔrɔtɔko nimɔrɔw ɲɛbilasɛbɛn

--- .

Sosow sɛgɛsɛgɛra¶

• Sibɛri lakanani ni fɛnsɔrɔko lakanani baarada (CISA) & FBI (Amerika): Sibɛri lakanani ladilikan jɛlenw Infostealer malware (LummaC2, RedLine, Rhadamanthys) ani Token/Session Sonya nɔgɔyali (CSAE24 / MITRE ATT&CK T1539: Steal Web Session Cookie & T1550.004: Web Session Kukisɛ).
• Jamana ka sariyaw ni seko ni dɔnko baarada (NIST) (Amerika): NIST SP 800-63B: Nizɛri danyɔrɔ laadilikanw: Session management, reauthentication, ani Token Binding.
• Diɲɛ ɛntɛrinɛti jɛkulu (W3C) & Google Chromium Lakanali Architecture: Device Bound Session Credentials (DBSC) ɲɛfɔli ani Chrome App-Bound Encryption (v20 DPAPI Elevation) Fɛɛrɛsɛbɛnw.
• Jamana ka sibɛri lakanani baarada (NCSC) (Royaume-Uni): Ka porogaramu juguw, Infostealers, ani Session Hijacking nɔgɔya baarakɛda ni musakabɔlaw ka sigidaw la.
• Diɲɛ kɔnɔ baarakɛminɛnw lakanani porozɛ da wulilen (OWASP): Session Management Cheat Sheet & OAuth 2.0 Token Revocation (RFC 7009) sariyaw.