Mmechi Token nke Oge, Infostealer Malware, na mwepu nnọkọ zuru ụwa ọnụ¶

Ịchọpụta na onye na-awakpo biputere scam cryptocurrency site na YouTube, Instagram, Discord, ma ọ bụ akaụntụ X gị, mepụtara iwu mbugharị na igbe mbata Gmail ma ọ bụ Microsoft 365, ma ọ bụ nweta njikwa igwe ojii nke ụlọ ọrụ gị ** na-eweliteghị koodu 2FA na ekwentị gị ma ọ bụ ozi email "nbanye ọhụrụ"** bụ mbinye aka na-enweghị mgbagha nke **Session-the Kuki. ** Infostealer Malware ***. Mgbe ị banyere na webụsaịtị wee lelee "Dọọ ka m banye", ihe nkesa ahụ na-ewepụta kuki nnọkọ HTTP ezoro ezo ma ọ bụ akara OAuth (dị ka nke Google). SID / SAPISID, Microsoft ESTSAUTHPERSISTENT, ma ọ bụ Discord's Authorization token) echekwara n'ime nchekwa data SQLite mpaghara ihe nchọgharị weebụ gị.

Ezinaụlọ infostealer malware, gụnyere **Lumma Stealer, RedLine, Vidar, Raccoon, StealC, RisePro, Rhadamanthys na Atomic macOS Stealer (AMOS) ***, echela na kọmpụta gị dị ka nje ọdịnala. A na-agbanwekarị ka ụdị egwuregwu adịgboroja, ihe nrụnye sọftụwia gbawara agbawa, adịgboroja "ClickFix" PowerShell CAPTCHA ngwa ngwa, ma ọ bụ na-akwado nkwado PDF, onye na-ahụ maka mgbasa ozi na-eme na ** n'okpuru 4 sekọnd **, na-ewepụ Chrome, Edge, Brave, ma ọ bụ Firefox gị. Cookies na Login Data ọdụ data na ebe nchekwa, zipu ha na desktọpụ gị faịlụ wallet cryptocurrency, bulite ebe nchekwa na ihe nkesa Telegram ma ọ bụ C2, yana ** na-ehichapụ onwe ya ***. Mgbe onye mwakpo bubatara kuki nnọkọ ezumike gị n'ime ihe nchọgharị na-egbochi nchọpụta (Multilogin, Dolphin{anty}, ma ọ bụ Gologin), sava weebụ na-eche na onye na-awakpo * bụ * kọmpụta gị enwetaralarị, na-agafe ma paswọọdụ gị yana nyocha ihe abụọ gị.

Mee nke a ugbu a¶

1. ** Kwụsị ịgbanwe okwuntughe gị na kọmpụta nwere ọrịa ahụ, kwụpụ PC ma ọ bụ Mac ahụ ozugbo na Wi-Fi wee wepụ eriri Ethernet ya.** Nke a bụ njehie #1 ndị ahụ metụtara na-eme: ha na-achọpụta na a tọọrọ Discord, Steam, ma ọ bụ Gmail ha, nọdụ ala n'otu PC desktọpụ butere ọrịa, wee pịnye paswọọdụ ọhụrụ n'ime Chrome. Ọ bụrụ na onye na-ebu ihe nkwụsi ike infostealer ma ọ bụ ọrụ ahaziri ka na-arụ ọrụ na igwe ahụ, ọ ga-ejide okwuntughe ọhụrụ gị na kuki nnọkọ ọhụrụ wee zighachi ha ozugbo na onye mwakpo ahụ. Mee 100 pasent nke mgbanwe paswọọdụ gị na mwepu nnọkọ site na ** ama dị ọcha (na data ekwentị ma ọ bụ Wi-Fi dị ọcha) ma ọ bụ laptọọpụ dị iche, nke emetụghị**.
2. Ghọta na ịgbanwe paswọọdụ naanị ọ bụghị mgbe niile na-emebi kuki nnọkọ ezuru ma ọ bụ akara ngosi OAuth ume ọhụrụ, ị ga-enwerịrị pịa "Banye na nnọkọ niile" ma kagbuo ngwa OAuth nke ndị ọzọ. N'ọtụtụ nyiwe (yana Google enweghị akwụkwọ ikike. MultiLogin / issueToken Ihe njedebe OAuth ma ọ bụ akara ngosi nnọkọ ogologo oge), naanị ịgbanwe paswọọdụ gị ma ọ bụ ịtụgharị 2FA nwere ike ịhapụ akara ngosi nnọkọ nke abụọ ma ọ bụ akara ngosi OAuth dị ndụ belụsọ ma i mebere usoro ** Global Session & Token Revocation** nzọụkwụ na tebụl dị n'okpuru.
3. ** Ọ bụrụ na ị nwere ngwanrọ cryptocurrency ndọtị ndọtị (MetaMask, Phantom, Rabby, Trust Wallet, Coinbase Wallet, Exodus, Electrum) arụnyere na kọmpụta nwere ọrịa ahụ, jiri ekwentị dị ọcha ugbu a wepụ ego gị gaa na mkpụrụokwu mkpụrụ obere akpa ngwaike ọhụrụ.Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn maka MetaMask) n'akụkụ okwuntughe echekwara ihe nchọgharị gị. Ọbụlagodi na onye mwakpo ahụ emetụbeghị crypto gị, faịlụ vault gị arịọlarị n'ahịa darknet na-eche cracker GPU na-anọghị n'ịntanetị. Gbuo anyị Mgbapu obere akpa cryptocurrency na mkpụrụ okwu mebie ndu ozugbo.
4. ** Chekwaa "Akaụntụ Identity Apex" gị (Email mbụ, njikwa okwuntughe, Akaụntụ Apple/Google na Ụlọọrụ SSO) n'ime nkeji iri mbụ.** Na ekwentị gị dị ọcha, mepee isi ** Google / Gmail gị (myaccount.google.com/device-activity*** na ** Microsoft (mysignins.microsoft.com*** akaụntụ mbụ. Banye na nnọkọ desktọpụ niile, gbanwee paswọọdụ nna ukwu, lelee ** Ntọala> Mbugharị na POP/IMAP *** na ** Nzacha / Iwu *** ka ihichapụ iwu mbugharị email zoro ezo onye mwakpo ahụ mepụtara iji zoo paswọọdụ-tọgharịa ozi-e sitere na ọrụ ndị ọzọ, wee lelee Passkey edebanye aha na ngwaọrụ nyocha.
5. ** Nyochaa ndekọ Windows gị Run igodo, Onye nhazi ọrụ, na akụkọ PowerShell ma ọ bụrụ na ị gbara iwu CAPTCHA adịgboroja "ClickFix" na nso nso a (Win + R -> Ctrl + V() Win + R, pịa Ctrl + V, and press Enter to verify you are human"* (which silently executes a hidden mshta.exe ma ọ bụ powershell -w hidden -enc ... command copied to your clipboard).
6. Maintain perspective and protect physical safety if the breach involves corporate infrastructure or extortion. Infostealer logs frequently trigger automated ransom or sextortion emails quoting your stolen password. Never pay extortionists; see our sextortion and online blackmail guide, and if you ever face a physical threat, call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom, or see our nọmba mberede ndekọ).

Infostealer & session cookie hijacking incident response decision tree¶

flowchart TD
    Root["Suspected Session Cookie Hijacking or Infostealer Malware Infection"] --> IsolatePC["STEP 1: Immediately Disconnect Infected PC/Mac from Wi-Fi & Ethernet (Do NOT Change Passwords on Infected PC)"]

    IsolatePC --> CryptoCheck{"Were Any Crypto Wallet Extensions (MetaMask, Phantom, Exodus) on That PC?"}
    CryptoCheck -->|"Ee"| EvacCrypto["Use a Clean Phone/Hardware Wallet Immediately to Sweep All Crypto Assets to a Brand-New Seed Phrase"]
    CryptoCheck -->|"Mba"| ApexLock["STEP 2: On a Clean Smartphone, Lock Down Primary Email (Gmail, Outlook, Proton) First"]
    EvacCrypto --> ApexLock

    ApexLock --> GlobalRevoke["STEP 3: Execute Global Session + OAuth Token + Passkey Revocation Across All Critical Accounts (See Platform Matrix Below)"]

    GlobalRevoke --> ExportList["Kwụpụ 4: Na PC ebutere ọrịa na-anọghị n'ịntanetị, bupụ ndepụta okwuntughe nchọgharị na kuki niile echekwara iji mara nke ọma akaụntụ ndị ezuru."]

    ExportList --> CleanOS["Kwụpụ 5: Kwado naanị akwụkwọ nkeonwe -> Mepụta OS dị ọcha Hichapụ/Tigharịa -> debanye aha passkeys wee mee ka nzuzo nke ngwa Chrome rụọ ọrụ."]

Ịghọta ka ndị Infostealers si agafe 2FA na DPAPI / Keychain izo ya ezo¶

Kedu ka mmemme 200 kilobyte ga-esi zuru okwuntughe na kuki nnọkọ nke Google Chrome, Microsoft Edge na Brave na-ezochi na draịvụ ike gị?

1. ** Windows DPAPI (CryptUnprotectData) na Chrome App-Bound izo ya ezo (v20***:
2. Na Windows, ihe nchọgharị dabere na Chromium (Chrome, Edge, Brave, Opera, Vivaldi) na-echekwa okwuntughe gị echekwara n'ime. %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data na kuki nnọkọ gị n'ime \Network\Cookies.
3. Ezobere ọdụ data SQLite ndị a site na iji igodo ukwu AES-256-GCM echekwara na ya %LOCALAPPDATA%\Google\Chrome\User Data\Local State, nke Windows Data Protection API (DPAPI) na-echekwa na akaụntụ njirimara Windows gị abanyela.
4. N'ihi na ị na-agba ọsọ infostealer * dị ka onye ọrụ Windows gị abanyela*, usoro ọ bụla na-agba n'okpuru akaụntụ onye ọrụ gị nwere ike ịkpọ akụkọ ihe mere eme. CryptUnprotectData() ịrịọ Windows ka ọ mebie igodo ahụ. Na ịgafe ** Chrome 127+ App-Bound encryption (v20 ọrụ elevator)**, ndị infostealers ọgbara ọhụrụ na-agbaba ozugbo n'ime enweghị isi chrome.exe usoro debugging (--remote-debugging-port) ma ọ bụ jiri elu COM rịọ Chrome n'onwe ya ka ọ tụfuo kuki niile emebi emebi.
5. ** Keychain macOS & Atomic macOS Stealer (AMOS / PoseStealer) ***:
6. Na Apple macOS, ndị infostealers na-agbanwe dị ka .dmg nbudata (na-ajụkarị gị ka "pịa aka nri -> Mepee" ma ọ bụ dọrọ akara ngosi gaa na ** Terminal ** ka ị gafere Apple Gatekeeper) gbapụta igbe okwu macOS adịgboroja na-agụ "Mmasị sistemụ chọrọ ịnweta ozi nzuzo gị: Tinye paswọọdụ nbanye Mac gị". Ozugbo ị pịnyere paswọọdụ nbanye Mac gị n'ime ngwa ahụ, edemede ahụ ga-emeghe -/Library/Keychains/login.keychain-db na detuo kuki Safari/Chrome, Apple Notes, na iCloud tokens.
7. ** Google MultiLogin / OAuthLogin Mweghachi Token na-erigbu ***:
8. Security researchers revealed that infostealers do not just steal standard web cookies, they also extract undocumented oauth_token akara ọrụ sitere na Chrome's Web Data (token_service table) SQLite file. Even after a victim changes their Google password once, attackers could previously replay the stolen token_service OAuth token against Google's internal OAuthLogin endpoint to mint brand-new valid SID browser cookies unless the user explicitly signed out the compromised Chrome device session AND revoked third-party/OAuth device access.

Step 1: Global Session, Cookie, OAuth, and Passkey Revocation Matrix¶

Using a clean smartphone or clean secondary computer, work down this exact table from top to bottom. Order matters: always do Step A (Sign out all active sessions/devices) and Step B (Change password) and Step C (Audit 2FA/Passkeys/OAuth/Forwarding) together, if you only change your password without terminating active sessions, the attacker's live browser tab stays logged in and can watch you or add a rogue recovery method.

Kwụpụ 2: Otu esi achọpụta akaụntụ ọ bụla ekpughere na kọmputa gị butere¶

Mgbe ị kpọchichara akaụntụ 10 gị dị oke egwu na ekwentị gị dị ọcha, ajụjụ na-agwụ ike ga-eche gị ihu: "Ejila m kọmputa ahụ afọ anọ, kedu ka m ga-esi mara nke n'ime weebụsaịtị 250 m chekwadoro okwuntughe ma ọ bụ kuki na-arụ ọrụ n'ime Chrome/Edge mgbe onye infostealer gbara ọsọ?"

Mgbe ị na-edobe kọmpụta nwere ọrịa 100 na-anọghị n'ịntanetị (Wi-Fi OFF, Ethernet unplugged), gbanye ya wee wepụ ngwa ngwa ikpughe gị ozugbo ihichapụ igwe:

1. ** Bupụ ndepụta okwuntughe echekwara ihe nchọgharị gị (CSV***:
2. Mepee ihe nchọgharị gị na-anọghị n'ịntanetị (chrome://password-manager/settings na Chrome, edge://wallet/settings na Edge, ma ọ bụ about:logins na Firefox) wee pịa ** Mbupụ okwuntughe *** iji chekwaa Chrome Passwords.csv banye na draịvụ USB dị ọcha.
3. ** Gịnị kpatara faịlụ a ji bụrụ ọla edo maka mgbake gị ***: Onye infostealer zuru nchekwa data a. Inwe Chrome Passwords.csv N'ihu gị na-enye gị ** ndepụta nlele nke aha njirimara webụsaịtị ọ bụla na paswọọdụ onye mwakpo ahụ nwere ugbu a ***, yabụ ị gaghị echefu Portal ụtụ isi ochie, akaụntụ kilomita ụgbọ elu, ma ọ bụ saịtị ịzụ ahịa nwere kaadị kredit echekwara.
4. ** Nyochaa weebụsaịtị webụsaịtị nwere kuki Oge na-arụ ọrụ (chrome://settings/content/all***:
5. Na Chrome ma ọ bụ Edge (mgbe ọ na-anọghị n'ịntanetị), gaa na chrome://settings/content/all (ma ọ bụ edge://settings/content/all) wee hazie ya site na Data echekwara ma ọ bụ kachasị leta. Weebụsaịtị ọ bụla ị nọrọ na-abanye na-enweghị pịnye okwuntughe enweghị ike izu ohi kuki ma chọọ ka akwụsị nnọkọ ya.
6. ** Lelee ma ọ bụrụ na akpọchiri njikwa paswọọdụ Standalone gị (1Password, Bitwarden, KeePassXC) n'oge ọrịa.
7. ** Ọ bụrụ na 1Password gị, Bitwarden, ma ọ bụ KeePassXC kpọchiri akpọchi** mgbe onye na-ahụ maka infostealer na-agba ọsọ: malware nwere ike ijide naanị cache mpaghara ezoro ezo.data.json ma ọ bụ .kdbx), nke PBKDF2-SHA256 / Argon2id + na-echekwa paswọọdụ nna ukwu gị (na igodo nzuzo nke mkpụrụedemede 34 na 1Password). Ọ bụrụ na Paswọdu Nna-ukwu gị siri ike, ihe dị n'ime gị ga-adị mma, n'agbanyeghị na ị ka kwesịrị ịtụgharị Paswọdu Nna-ukwu gị ka ịkpachara anya.
8. ** Ọ bụrụ na akpọchiri ndọtị ihe nchọgharị njikwa okwuntughe gị na ebe nchekwa *** mgbe malware na-agba ọsọ (ma ọ bụ ọ bụrụ na ịchekwaa paswọọdụ njikwa paswọọdụ gị n'ime ihe arụrụ arụrụ n'ime Chrome.): Were ya na infostealer tụfuru vault gị ma ọ bụ weghara paswọọdụ nna ukwu gị, wee tụgharịa nzere niile dị mkpa n'ime vault gị.

Kwụpụ 3: Ịchụ nta na ikpochapụ Infostealer nnọgidesi ike tupu ihichapụ OS¶

Tupu ị kwado akwụkwọ nkeonwe gị ma rụọ ọrụ nrụpụta OS dị ọcha, ị nwere ike lelee ka onye infostealer si abanye na sistemụ gị yana ma ọ tụfuru ihe nrụnye nke abụọ na-adịgide adịgide (dị ka Ọrụ hazigharịrị, Registry). Run igodo, mmalite .lnk ụzọ mkpirisi, ma ọ bụ ihe ndọtị Chrome ọjọọ):

1. Gbaa nyocha nke PowerShell na-anọghị n'ịntanetị (Windows)¶

Mepee PowerShell (Admin) na PC na-anọghị n'ịntanetị wee mee nyocha nyocha naanị ọgụgụ anọ a:

# 1. Check the Windows Run/RunOnce Registry Keys for user-level malware loaders in AppData/Temp:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                       "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
                       "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue

# 2. Check the Startup Folder for suspicious .lnk, .vbs, .bat, or .exe files:
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
                    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force

# 3. List all Scheduled Tasks created or modified in the last 7 days calling PowerShell, cmd, mshta, or AppData:
Get-ScheduledTask | Where-Object { $_.State -ne "Disabled" } | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    foreach ($action in $_.Actions) {
        if ($action.Execute -match "powershell|cmd|mshta|wscript|cscript|rundll32|regsvr32|AppData|Temp|ProgramData") {
            [PSCustomObject]@{
                TaskName = $_.TaskName
                Execute  = $action.Execute
                Args     = $action.Arguments
                LastRun  = $info.LastRunTime
            }
        }
    }
} | Format-Table -AutoSize

# 4. Check Windows Defender Exclusions (Infostealers immediately add C:\ or AppData to Defender Exclusions.):
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath | ForEach-Object { Remove-MpPreference -ExclusionPath $_ }

2. Gịnị mere a dị ọcha OS Reinstall (site na USB Media) na-akwado mgbe ihe Infostealer¶

Mgbe ị na-agba ọsọ ** Microsoft Defender Offline Scan *** na ** Malwarebytes *** mgbe ikpochapụ ndị na-agbachitere ewepu na-ewepụ ndị na-ebu ibu ama ama, ndị na-ahụ maka ngwa ahịa na-ejikọta nke abụọ RAT (Trojan Remote Access Trojan), SystemBC SOCKS5 proxy, ma ọ bụ clipper malware (nke Windows gị na-enyo enyo enyo ma na-enyo enyo malware). adreesị obere akpa na adreesị onye hacker). - Ozugbo i depụtaghachiri akwụkwọ, foto na nkeonwe gị Chrome Passwords.csv gbanyụọ PC na-anọghị n'ịntanetị, rụọ ọrụ dị ọcha ** Windows 11 USB Reinstall ** (ma ọ bụ ** macOS Ihichapụ ọdịnaya na ntọala niile **) na-eso nke anyị. malware, ransomware, na spyware ntuziaka ọrịa.

3. Auditing MacOS na Linux Systems maka Infostealer Artifacts (Atomic macOS Stealer / AMOS, Poseidon, na ihe nchọgharị obi ọjọọ)¶

Ọ bụrụ na igwe butere ọrịa gị bụ Apple MacBook/iMac ma ọ bụ onye nrụpụta Linux na-arụ ọrụ karịa Windows PC, mee nyocha ọnụ ọnụ ndị a na-anọghị n'ịntanetị iji chọpụta ma kpochapụ nkwụsi ike:

# On Apple macOS:
# 1. Check for unauthorized LaunchAgents and LaunchDaemons dropped by AMOS / Poseidon Stealer:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

# 2. Check for hidden staging folders in /tmp or /var/folders created by AppleScript / osascript stealers:
find /tmp /var/folders -iname "*out.zip*" -o -iname "*passwords.txt*" -o -iname "*cookies*" 2>/dev/null

# 3. Inspect installed Chrome / Brave / Edge Extensions for rogue manifest permissions ('cookies', 'webRequest', '<all_urls>'):
grep -rn '"permissions"' ~/Library/Application\ Support/Google/Chrome/Default/Extensions/ 2>/dev/null

4. Ihe njikwa ụlọ ọrụ na igwe ojii (NJ Microsoft Entra, Okta, Google Workspace, na AWS IAM)¶

Ọ bụrụ na kọmpụta nke onye infostealer butere bụ nke injinia sọftụwia, onye nchịkwa DevOps, ma ọ bụ onye ọrụ ụlọ ọrụ nwere nnọkọ na-arụ ọrụ na ** Microsoft Entra ID (Azure AD), Okta, Google Workspace, AWS, ma ọ bụ Cloudflare **, mkpocha ngwaọrụ mpaghara bụ naanị ọkara agha. Mee kagbuchapụ ndekọ igwe ojii ndị a ozugbo:

• ** Microsoft Entra ID (Revoke-MgUserSignInSession***: Ịpị "Apụọ" n'otu ihe nchọgharị anaghị ewepụ Primary Refresh Tokens (PRTs) ma ọ bụ Azure CLI (az login / .azure/msal_token_cache.bin) akara ndị e depụtaghachiri na diski. Onye nchịkwa Entra ga-agba ọsọ Revoke-MgUserSignInSession -UserId user@company.com na Microsoft Graph PowerShell iji tọgharịa onye ọrụ signInSessionsValidFromDateTime wepụta ma mebie Token ume ọhụrụ n'ofe njedebe niile n'otu oge.
• ** AWS CLI & Onye Mmepụta Token ntụgharị (-/.aws/credentials, -/.npmrc, -/.pypirc, -/.kube/config*** Ndị na-ahụ maka ngwa ahịa na-enyocha akwụkwọ ndekọ ụlọ onye ọrụ ọ bụla nke ọma .aws/credentials, .ssh/id_ed25519, .gitconfig, .env, na Docker/Kubernetes config faịlụ. Gbanyụọ ozugbo wee tụgharịa ihe niile ** AWS IAM igodo nnweta (AKIA...*** na AWS Console, kagbuo ** GitHub Nnweta Nweta Onwe Onye (ghp_...***, ma hichapụ igodo ọha SSH ekpughere na sava mmepụta (-/.ssh/authorized_keys).
• ** Izi ozi na Desktọpụ & VPN mkpochapụ ndị ahịa (Telegram Desktop tdata, Signal, Slack, OpenVPN, WireGuard): E wezụga ihe nchọgharị weebụ, modul infostealer na-edobe ya kpọmkwem. %APPDATA%\Telegram Desktop\tdata ndekọ (nke na-enye onye na-awakpo ohere imechi akaụntụ Telegram gị niile na PC ha na-enweghị koodu SMS), %APPDATA%\Slack\storage, wee chekwaa ** OpenVPN (.ovpn) / WireGuard (.conf* Profaịlụ VPN ụlọ ọrụ. Mepee Telegram na ekwentị gị (**Ntọala> Ngwaọrụ -> Kwụsị Oge Ndị ọzọ niile **), pụọ ​​na oghere ọrụ Slack niile (slack.com/account/settings -> * Hapụ nnọkọ ndị ọzọ niile), ma rịọ onye nchịkwa netwọk gị ka ọ kagbuo ma nyeghachi akwụkwọ ikike ndị ahịa VPN ụlọ ọrụ gị.

Mgbochi: Otu esi eme ka ihe nchọgharị gị na akaụntụ gị ghara igbochi Infostealers¶

Ozugbo sistemu gị dị ọcha ma nwetaghachi akaụntụ gị, mejuputa ihe nchekwa ise ndị a ka onye na-ahụ maka infostealer enweghị ike ịdọrọ ndụ dijitalụ gị ọzọ:

• ** echekwala okwuntughe n'ime njikwa okwuntughe arụnyere ihe nchọgharị weebụ gị (Chrome / Edge / Brave / Firefox Autofill) na-enweghị igodo ngwaike/Master : ngwa ahịa ọ bụla na-ahụ maka ụwa na-elekwasị anya Chrome. Login Data Tebụl SQLite mbụ. Gbanyụọ ** Gbanyụọ *** "Nye maka ịchekwa okwuntughe" n'ime chrome://password-manager/settings ma chekwaa okwuntughe gị n'ime onye njikwa okwuntughe efu nke efu ( 1Password, Bitwarden, Proton Pass, ma ọ bụ KeePassXC**) ahaziri na ** Auto-Lock ozugbo mgbe sistemụ kpochiri ma ọ bụ mgbe nkeji ise gachara.
• ** Kwado "Nkwenye Nkwekọrịta Ngwaọrụ-Bound (DBSC)" & "Enyocha ngwa-Bound" na Chrome 127+**: Gbaa mbọ hụ na emelitere Google Chrome ma ọ bụ Edge na ụdị kachasị ọhụrụ wee tinye ya na ndekọ sistemụ ndabara (C:\Program Files\Google\Chrome\Application) ya mere GoogleChromeElevationService nwere ike jikọta izo ya ezo kuki na ọkwa ihe ùgwù sistemụ yana igodo ngwaike TPM site na Nkwekọrịta Nzuko Ngwa-Bound (DBSC).
• ** Gbanyụọ igbe ọsọ Windows (Win + R) ma ọ bụ mshta.exe iji gbochie "ClickFix" Mwakpo CAPTCHA adịgboroja ***: Adịla pịa Win + R -> Ctrl + V -> Enter mgbe webụsaịtị CAPTCHA, ihuenyo Cloudflare adịgboroja, ma ọ bụ “Fix Microphone / Fix Font” mmapụta na-arịọ gị ka mado iwu n'ime dialog Run ma ọ bụ Terminal gị, ọ nweghị weebụsaịtị ziri ezi n'ụwa na-enyocha mmadụ site na ịrịọ gị ka mado koodu n'ime ya. Win + R ma ọ bụ MacOS Terminal.
• ** Jiri igodo Nchekwa ngwaike (YubiKey) ma ọ bụ Passkey + chọrọ nyocha ọzọ maka omume nwere mmetụta ***: Mgbe kuki ezuru ezu ohi na-agafe nbanye nbanye mbụ, nyiwe ndị isi (Google, GitHub, Cloudflare, AWS, Coinbase) na-amanye ** Nzọụkwụ-Up Nyochaa (Sudo Yupkey) ma ọ bụ FIDO nke anụ ahụ. lelee tupu ikwe ka onye ọ bụla nwere kuki nnọkọ gbanwee paswọọdụ gị, data mbupụ, ma ọ bụ tinye adreesị mwepụ.
• ** Lelee ma email gị ma ọ bụ ndekọ ihe ohi apụtala na ebe nchekwa data nlekota Darknet ***: Gaa na haveibeenpwned.com (nke na-edepụta nde nde adreesị ozi-e onye na-ezu ohi na ngalaba mebie) ma mee ka amamọkwa nbibi darknet efu maka adreesị ozi-e gị.
• ** Wepụ nbudata ndị atụkwasịghị obi, mods egwuregwu, na edemede ndị ọzọ n'ime igwe mebere ma ọ bụ Windows Sandbox **: agbala ọsọ na-akwadoghị. .exe, .msi, .dmg, .bat, ma ọ bụ Python pip / Ọnụ npm scripts tinye n'ọrụ ozugbo na sistemụ arụmọrụ nnabata nke na-ejide oge ihe nchọgharị weebụ gị nke ọma yana nbanye ego. Kwado Windows Sandbox (wuru n'ime Windows 10/11 Pro na Enterprise site na * Gbanyụọ ma ọ bụ gbanyụọ njirimara Windows> Windows Sandbox) ma ọ bụ jiri igwe mebere dịpụrụ adịpụ nwere kuki ihe nchọgharị echekwara efu mgbe ị na-anwale akụrụngwa ndị ọzọ.

Ajụjụ a na-ajụkarị¶

Ntuziaka emetụtara¶

• Malware, ransomware, na spyware ọrịa
• MFA phishing na onye iro-na-etiti (AiTM) gafere
• MFA mkpọchi: otu esi enwetaghachi akaụntụ akpọchiri
• E mejọrọ akaụntụ email, iwu mbugharị na mgbake
• Mgbapu obere akpa Cryptocurrency na nkebi ahịrịokwu mkpụrụ mebie
• Mkpọchi njikwa okwuntughe yana mgbake oghere mberede
• Ndekọ nọmba mberede

enyochara isi mmalite¶

• Cybersecurity na Akụrụngwa Nchekwa Agency (CISA) & FBI (United States): *Ndụmọdụ njikọ Cybersecurity na Infostealer Malware (LummaC2, RedLine, Rhadamanthys) na Mitigating Token/Session Izu (CSAE24 / MITER ATT&CK T1539: Zuru Kuki Kuki Webụsaịtị500 Session).
• National Institute of Standards and Technology (NIST) (United States): NIST SP 800-63B: Digital Identity Guidelines: Session Management, Reauthentication, and Token Binding.
• Consortium Webụsaịtị zuru ụwa ọnụ (W3C) & Nhazi nchekwa Google Chromium: Nkọwapụta Nkwekọrịta Mgbakọ Ngwa (DBSC) yana nzuzo ngwa-Bound Chrome (v20 Elu DPAPI) Nka na ụzụ.
• National Cyber ​​​​Security Center (NCSC) (United Kingdom): * Mbelata Malware, Infostealers, na Hijacking Session in Enterprise and Consumer Environment*.
• Mepee oru nchekwa nchekwa ngwa zuru ụwa ọnụ (OWASP): * Akwụkwọ njikwa aghụghọ & OAuth 2.0 Token nwepụ (RFC 7009) Ụkpụrụ*.