Session Token Hijacking, Infostealer Malware, and Global Session Revocation¶

Discovering that an attacker just posted cryptocurrency scams from your YouTube, Instagram, Discord, or X account, created forwarding rules in your Gmail or Microsoft 365 inbox, or accessed your corporate cloud console without ever triggering a 2FA code on your phone or a "New Login" email alert is the unmistakable signature of Session Cookie / Token Hijacking (Pass-the-Cookie) caused by Infostealer Malware. When you log into a website and check "Keep me signed in", the server issues an encrypted HTTP session cookie or OAuth bearer token (such as Google's SID / SAPISID, Microsoft's ESTSAUTHPERSISTENT, or Discord's Authorization token) stored inside your web browser's local SQLite database.

Commodity infostealer malware families, including Lumma Stealer, RedLine, Vidar, Raccoon, StealC, RisePro, Rhadamanthys, and Atomic macOS Stealer (AMOS), do not wait around on your computer like traditional viruses. Often disguised as a fake game mod, cracked software installer, fake "ClickFix" PowerShell CAPTCHA prompt, or sponsor collaboration PDF, an infostealer executes in under 4 seconds, decrypts your Chrome, Edge, Brave, or Firefox Cookies mpi Login Data databases in memory, zips them up with your desktop cryptocurrency wallet files, uploads the archive to a Telegram or C2 server, and deletes itself. When the attacker imports your stolen session cookies into an anti-detect browser (Multilogin, Dolphin{anty}, or Gologin), the web server thinks the attacker is your already-authenticated computer, completely bypassing both your password and your two-factor authentication.

Sala yo sesepi¶

1. STOP changing your passwords on the infected computer, immediately disconnect that PC or Mac from Wi-Fi and unplug its Ethernet cable. This is the #1 mistake victims make: they notice their Discord, Steam, or Gmail was hijacked, sit down at the exact same infected desktop PC, and type brand-new passwords into Chrome. If an infostealer persistence loader or scheduled task is still active on that machine, it will immediately capture your new passwords and fresh session cookies and send them right back to the attacker. Do 100 percent of your password changes and session revocations from a clean smartphone (on cellular data or clean Wi-Fi) or a separate, untouched laptop.
2. Understand that changing a password alone does NOT always invalidate stolen session cookies or OAuth refresh tokens, you MUST explicitly click "Sign Out of All Sessions" AND revoke third-party OAuth apps. On several platforms (and with Google's undocumented MultiLogin / issueToken OAuth endpoints or long-lived session tokens), simply changing your password or rotating 2FA can leave existing secondary session tokens or OAuth desktop tokens alive unless you execute the platform-specific Global Session & Token Revocation steps in the table below.
3. If you have a software cryptocurrency wallet extension (MetaMask, Phantom, Rabby, Trust Wallet, Coinbase Wallet, Exodus, Electrum) installed on the infected computer, use a clean phone right now to evacuate your funds to a brand-new hardware wallet seed phrase. Infostealer logs automatically harvest the encrypted vault files (Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn for MetaMask) alongside your browser saved passwords. Even if the attacker has not touched your crypto yet, your vault file is already sitting on a darknet market waiting for an offline GPU cracker. Execute our cryptocurrency wallet drain and seed phrase compromise guide immediately.
4. Secure your "Apex Identity Accounts" (Primary Email, Password Manager, Apple/Google Account, and Corporate SSO) in the first 10 minutes. On your clean smartphone, open your primary Google / Gmail (myaccount.google.com/device-activity) and Microsoft (mysignins.microsoft.com) accounts first. Sign out all desktop sessions, rotate the master password, check Settings > Forwarding and POP/IMAP and Filters/Rules to delete any hidden email forwarding rules the attacker created to hide password-reset emails from other services, and check registered Passkeys and Authenticator devices.
5. Audit your Windows Registry Run keys, Task Scheduler, and PowerShell history if you recently ran a "ClickFix" fake CAPTCHA command (Win + R -> Ctrl + V). One of the fastest-growing infostealer vectors today is a fake Cloudflare or Google CAPTCHA popup on a webpage that instructs you to "Press Win + R, press Ctrl + V, and press Enter to verify you are human" (which silently executes a hidden mshta.exe to powershell -w hidden -enc ... command copied to your clipboard).
6. Maintain perspective and protect physical safety if the breach involves corporate infrastructure or extortion. Infostealer logs frequently trigger automated ransom or sextortion emails quoting your stolen password. Never pay extortionists; see our sextortion and online blackmail guide, and if you ever face a physical threat, call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom, or see our nimero ya urgence répertoire).

Infostealer & session cookie hijacking incident response decision tree¶

flowchart TD
    Root["Suspected Session Cookie Hijacking or Infostealer Malware Infection"] --> IsolatePC["STEP 1: Immediately Disconnect Infected PC/Mac from Wi-Fi & Ethernet (Do NOT Change Passwords on Infected PC)"]

    IsolatePC --> CryptoCheck{"Were Any Crypto Wallet Extensions (MetaMask, Phantom, Exodus) on That PC?"}
    CryptoCheck -->|"Inga"| EvacCrypto["Use a Clean Phone/Hardware Wallet Immediately to Sweep All Crypto Assets to a Brand-New Seed Phrase"]
    CryptoCheck -->|"Ve"| ApexLock["STEP 2: On a Clean Smartphone, Lock Down Primary Email (Gmail, Outlook, Proton) First"]
    EvacCrypto --> ApexLock

    ApexLock --> GlobalRevoke["STEP 3: Execute Global Session + OAuth Token + Passkey Revocation Across All Critical Accounts (See Platform Matrix Below)"]

    GlobalRevoke --> ExportList["STEP 4: On Offline Infected PC, Export List of All Saved Browser Passwords & Cookies to Know Exactly Which Accounts Were Stolen"]

    ExportList --> CleanOS["STEP 5: Back Up Personal Documents Only -> Perform Clean OS Wipe/Reinstall -> Re-enroll Passkeys & Enable Chrome App-Bound Encryption"]

Understanding how Infostealers bypass 2FA and DPAPI / Keychain encryption¶

How can a 200-kilobyte program steal passwords and session cookies that Google Chrome, Microsoft Edge, and Brave encrypt on your hard drive?

1. Windows DPAPI (CryptUnprotectData) and Chrome App-Bound Encryption (v20):
2. On Windows, Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi) store your saved passwords inside %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data and your session cookies inside \Network\Cookies.
3. These SQLite databases are encrypted with an AES-256-GCM master key stored in %LOCALAPPDATA%\Google\Chrome\User Data\Local State, which is protected by the Windows Data Protection API (DPAPI) tied to your logged-in Windows user account.
4. Because you ran the infostealer as your own logged-in Windows user, any process running under your user account could historically call CryptUnprotectData() to ask Windows to decrypt the key. And to bypass Chrome 127+ App-Bound Encryption (v20 elevator service), modern infostealers inject directly into a headless chrome.exe debugging process (--remote-debugging-port) or use COM elevation to ask Chrome itself to dump all live decrypted cookies.
5. macOS Keychain & Atomic macOS Stealer (AMOS / PoseStealer):
6. On Apple macOS, infostealers disguised as .dmg downloads (often asking you to "Right-click -> Open" or drag the icon to Terminal to bypass Apple Gatekeeper) pop up a fake native macOS dialog box reading "System Preferences wants to access your confidential information: Enter your Mac login password". The instant you type your Mac login password into that prompt, the script unlocks -/Library/Keychains/login.keychain-db and copies Safari/Chrome cookies, Apple Notes, and iCloud tokens.
7. Google MultiLogin / OAuthLogin Token Regeneration Exploit:
8. Security researchers revealed that infostealers do not just steal standard web cookies, they also extract undocumented oauth_token service tokens from Chrome's Web Data (token_service table) SQLite file. Even after a victim changes their Google password once, attackers could previously replay the stolen token_service OAuth token against Google's internal OAuthLogin endpoint to mint brand-new valid SID browser cookies unless the user explicitly signed out the compromised Chrome device session AND revoked third-party/OAuth device access.

Step 1: Global Session, Cookie, OAuth, and Passkey Revocation Matrix¶

Using a clean smartphone or clean secondary computer, work down this exact table from top to bottom. Order matters: always do Step A (Sign out all active sessions/devices) and Step B (Change password) and Step C (Audit 2FA/Passkeys/OAuth/Forwarding) together, if you only change your password without terminating active sessions, the attacker's live browser tab stays logged in and can watch you or add a rogue recovery method.

Kitini ya 2: Mutindu ya kuzaba KONSO konti yina bo basisaka na ordinatere na nge yina vandaka ti maladi .¶

Na nima ya kukanga bakonti na nge 10 ya mfunu mingi na telefone na nge ya bunkete, nge kekutana ti ngyufula mosi ya mpasi: "Mu mesadilaka ordinatere yina bamvula iya, inki mutindu mu lenda zaba inki na kati ya basite na munu 250 vandaka ti ba mot de passe to ba cookies ya kesala na kati ya Chrome/Edge ntangu infostealer vandaka kusala?"

Ntangu nge ke tanina ordinatere yina kele ti maladi 100 na kati ya nkama na nganda ya nzila (Wi-Fi OFF, Ethernet me katuka na nzila), kangula yo mpi basisa inventaire na nge ya siki-siki ya exposition na ntwala ya kufwa masini:

1. Basisa Liste ya ba mot de passe yina nge me bumba na Navigateur (CSV):
2. Kangula navigateur na nge na nzila ve (chrome://password-manager/settings na Chrome, edge://wallet/settings na Edge, to about:logins na Firefox) mpi niema Basisa ba mot de passe sambu na kubumba . Chrome Passwords.csv na zulu ya disque dur USB ya bunkete.
3. Sambu na nki fichier yayi kele wolo sambu na récupération na nge: Infostealer yibaka base de données yayi ya sikisiki. Kuvanda Chrome Passwords.csv na ntwala na nge ke pesa nge listi ya siki-siki ya konso zina ya kusadila mpi mot de passe yina muntu yina ke nwanisa nge kele ti yo ntangu yai, sambu nge konda ve porte ya ntama ya kufuta mpaku, konti ya bakilometre ya avio, to kisika ya kusumba bima yina kele ti karte ya mfuka yina bo me bumbaka.
4. Tala nki basite internet vandaka ti ba cookies ya Session (chrome://settings/content/all):
5. Na Chrome to na Edge (ntangu nge kele ve na nzila), kota na chrome://settings/content/all (to edge://settings/content/all) mpi tula yo na ndonga na kutadila Bansangu ya bo me bumba to Bantu yina bo me tala mingi. Konso site Internet yina nge me kota kukonda kusonika mot de passe vandaka na kigonsa ya kuyiba ba cookies ya session mpi yo ke lombaka nde session na yo kumanisa.
6. Tala kana mfumu na nge ya ke twadisaka ba mot de passe (1Mot de passe, Bitwarden, KeePassXC) vandaka ya kukangula na ntangu ya maladi yai:
7. Kana kisika na nge ya kubumba bima ya 1Password, Bitwarden, to KeePassXC vandaka ya KUKANGA ntangu infostealer vandaka kusala: Programe ya mbi lendaka kukanga kaka kisika ya kubumba bima ya kisika yina bo me sonikaka (data.json to .kdbx), yina bo ke taninaka na PBKDF2-SHA256 / Argon2id + Mot de passe na nge ya Mfumu (mpi Nsabi ya Kinsweki ya kele ti bisono 34 na 1Mot de passe). Kana Mot de passe na nge ya Mfumu kele ngolo, mambu yina kele na kati ya kisika na nge ya kubumba bima ke bikalaka na lutaninu, ata nge fwete balula kaka Mot de passe na nge ya Mfumu sambu na kuditanina.
8. Kana extension ya navigateur ya gestionnaire ya ba mot de passe vandaka UNLOCKED na mémoire ntangu malware vandaka kusala (to kana nge bumbaka Mot de passe ya mfumu ya gestionnaire ya mot de passe na kati ya autofill ya Chrome.): Yindula nde infostealer losaka kisika na nge ya kubumba bima to kangaka Mot de passe na nge ya mfunu, mpi balula credential na ndambu na nge yonso ya mfunu.

3: Kuzomba mpi kukatula kukwamina ya Infostealer na ntwala ya kufwa OS .¶

Na ntwala ya kusala sauvegarde ya mikanda na nge mosi mpi kusala installation ya bunkete ya OS, nge lenda tala mutindu infostealer kotaka na systeme na nge mpi kana yo losaka chargeur ya zole yina kelanda na kusalama (bonso Scheduled Task, Registry . Run nsabi, Kuyantika .lnk nzila ya nkufi, to Extension ya Chrome ya mbi):

1. Sala Audit ya Kukwamina ya PowerShell yai (Windows)¶

Kangula PowerShell (Admin) na ordinatere yina kele na nzila ve mpi sala bansosa yai iya ya ke tadila mambu ya leta:

# 1. Check the Windows Run/RunOnce Registry Keys for user-level malware loaders in AppData/Temp:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                       "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
                       "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue

# 2. Check the Startup Folder for suspicious .lnk, .vbs, .bat, or .exe files:
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
                    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force

# 3. List all Scheduled Tasks created or modified in the last 7 days calling PowerShell, cmd, mshta, or AppData:
Get-ScheduledTask | Where-Object { $_.State -ne "Disabled" } | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    foreach ($action in $_.Actions) {
        if ($action.Execute -match "powershell|cmd|mshta|wscript|cscript|rundll32|regsvr32|AppData|Temp|ProgramData") {
            [PSCustomObject]@{
                TaskName = $_.TaskName
                Execute  = $action.Execute
                Args     = $action.Arguments
                LastRun  = $info.LastRunTime
            }
        }
    }
} | Format-Table -AutoSize

# 4. Check Windows Defender Exclusions (Infostealers immediately add C:\ or AppData to Defender Exclusions.):
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath | ForEach-Object { Remove-MpPreference -ExclusionPath $_ }

2. Ekuma divavanga vo twasia diaka OS yavelela (muna nzila ya Media USB) vava kivioka Infostealer .¶

Ntangu nge ke sala Microsoft Defender Offline Scan mpi Malwarebytes na nima ya kukatula ba exclusions ya Defender ke katula ba chargeurs ya persistance yina me zabana, bantu yina ke yibaka bansangu ya bima ke vukisaka mbala mingi proxy ya zole ya RAT (Trojan d’accès à distance), **SystemBC SOCKS5 tableau na nge ya Windows mpi ke sobaka konso adresi ya porte-monnaie ya Bitcoin/Ethereum yina bo me kotisa ti adresi ya muntu yina me kotisa mbongo). - Kana nge me sala bakopi ya mikanda na nge mosi, bafoto, mpi . Chrome Passwords.csv na nganda ya ordinatere yina kele ve na nzila, sala kisalu ya bunkete ya Kutula diaka USB ya Windows 11 (to Kufwa bima yonso mpi baparametre ya macOS) na nima ya . logiciel ya mbi, logiciel ya ransom, mpi logiciel ya espionage.

3. Kufimpa ba Sisteme ya macOS mpi ya Linux sambu na Bima ya Infostealer (Atomic macOS Stealer / AMOS, Poseidon, ye Extensions za Navigador za Mbi)¶

Kana masini na nge ya kele ti maladi kele Apple MacBook/iMac to station ya kisalu ya bantu yina ke salaka Linux na kisika ya kusadila ordinatere ya Windows, sala bansosa yai ya terminal yina kele ve na nzila sambu na kuzaba mpi kukatula mambu yina ke landa kusalama:

# On Apple macOS:
# 1. Check for unauthorized LaunchAgents and LaunchDaemons dropped by AMOS / Poseidon Stealer:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

# 2. Check for hidden staging folders in /tmp or /var/folders created by AppleScript / osascript stealers:
find /tmp /var/folders -iname "*out.zip*" -o -iname "*passwords.txt*" -o -iname "*cookies*" 2>/dev/null

# 3. Inspect installed Chrome / Brave / Edge Extensions for rogue manifest permissions ('cookies', 'webRequest', '<all_urls>'):
grep -rn '"permissions"' ~/Library/Application\ Support/Google/Chrome/Default/Extensions/ 2>/dev/null

4. Kukangama ya Bamfumu ya Bakompani mpi ya Matuti (ID ya Microsoft, Okta, Kisika ya Kisalu ya Google, mpi AWS IAM)¶

Kana ordinatere yina muntu mosi ya ke yibaka bansangu me bebisa kele ya muntu mosi ya ke salaka baprograme ya ordinatere, ya mfumu ya DevOps, to ya muntu ya kisalu ya kompani yina vandaka ti ba session ya ke salaka na Microsoft Entra ID (Azure AD), Okta, Google Workspace, AWS, to Cloudflare, kutula bunkete na ba apareyi ya bwala kele kaka ndambu ya bitumba. Sala mbala mosi mambu yai ya bo me katula na nzila ya matuti:

• ID ya kukota ya Microsoft (Revoke-MgUserSignInSession): Kubula "Kubasika" na navigateur mosi ke katulaka ve ntangu yonso Ba-Token ya Kuvutukila ya Ntete (PRT) to Azure CLI (az login / .azure/msal_token_cache.bin) tokens ya bo me kotisa na diske. Ntwadisi mosi ya Entra fwete sala Revoke-MgUserSignInSession -UserId user@company.com na PowerShell ya Graphique ya Microsoft sambu na kuvutula mambu ya muntu yina ke sadila yo . signInSessionsValidFromDateTime attribute mpi kufwa Ba Token yonso ya Refresh na ba nsuka yonso na mbala mosi.
• AWS CLI & Kubaluka ya Kidimbu ya Bantu ya Ke Salaka (-/.aws/credentials, -/.npmrc, -/.pypirc, -/.kube/config): Bantu yina ke yibaka bansangu ya bima ke talaka na pwelele yonso répertoire ya nzo ya konso muntu yina ke sadilaka yo sambu na . .aws/credentials, .ssh/id_ed25519, .gitconfig, .env, ye nkanda mia Docker/Kubernetes. Katula mbala mosi mpi balula Bafungula yonso ya AWS IAM (AKIA...) na Console ya AWS, katula Ba Token ya Kukota na GitHub (ghp_...), mpi katula bansapi ya bantu yonso ya SSH yina bo me basisa na baserveur ya kisalu (-/.ssh/authorized_keys).
• Kupesa Bansangu na Biro & Kukatula Token ya Kiliya ya VPN (Biro ya Telegram tdata, Signal, Slack, OpenVPN, WireGuard): Na nima ya ba navigateur ya Internet, ba module ya infostealer ke salaka bakopi ya sikisiki ya . %APPDATA%\Telegram Desktop\tdata directoire (yina ke pesaka muntu yina ke sosaka kufwa nge nzila ya kusala clone ya konti na nge ya mvimba ya Telegram na ordinatere na bo kukonda code SMS), . %APPDATA%\Slack\storage, mpi me bumba VPN ya kukangula (.ovpn) / Nsinga ya Nsinga (.conf) baprofile ya VPN ya kompani. Kangula Telegram na telefone na nge (Baparametre > Ba apareyi -> Sukisa Balukutakanu Yonso Yankaka), basika na bisika yonso ya kisalu ya Slack (slack.com/account/settings -> Basika na ba sessions yonso ya nkaka), mpi lomba mfumu ya réseau na nge na kukatula mpi kubasisa diaka certificat ya client VPN ya kompani na nge.

Kukangama: Mutindu ya kusala nde navigateur mpi bakonti na nge kukangama ve na Infostealers .¶

Kana systeme na nge me kuma bunkete mpi bakonti na nge me vutuka, sadila mitindu yai tanu sambu muntu yina ke yibaka bansangu kukanga diaka ve luzingu na nge ya elektroniki:

• BUMBA VE ATA FIOTI ba mot de passe na kati ya gestionnaire ya ba mot de passe ya intégré ya navigateur na nge ya internet (Chrome / Edge / Brave / Firefox Autofill) kukonda Nsabi ya Bima/ya Mfumu: Konso muntu yina ke yibaka bansangu ya bima na Ntoto ke tadilaka mambu ya Chrome . Login Data SQLite mesa ya ntete. Kangula OFF "Kupesa na kubumba ba mot de passe" na chrome://password-manager/settings mpi kubumba ba mot de passe na kati ya ngidika mosi ya bo me yidikaka sambu na yo, yina ke zabaka ve ata kima mosi (1Mot de passe, Bitwarden, Proton Pass, to KeePassXC) yina bo me yidikaka na Kukangama na mbala mosi ntangu ngidika ke kangamaka to na nima ya minuta 5 ya kukonda kusala kisalu.
• Kangula "Bansangu ya Session Liée à l'Appareil (DBSC)" & "Ecryption Liée à l'App" na Chrome 127+: Zikisa nde Google Chrome to Edge me kuma na version ya nsuka mpi bo me tula yo na répertoire ya systeme (C:\Program Files\Google\Chrome\Application) yo yina GoogleChromeElevationService lenda kanga encryption ya ba cookies na ba niveau ya privilège ya systeme mpi na ba clés ya bima ya TPM na nzila ya Crédentiels de session liées à l’appareil (DBSC).
• Katula kisika ya kusadila Windows (Win + R) to mshta.exe sambu na kukanga "ClickFix" Ba attaques ya luvunu ya CAPTCHA: Kufina ve ata fioti Win + R -> Ctrl + V -> Enter ntangu CAPTCHA ya site internet, écran ya Cloudflare ya luvunu, to pop-up ya "Fixer Microphone / Fixer Fonte" ke lomba nge na kutula ntuma na dialogue Run to na Terminal na nge, ata site mosi ve ya nsiku na Ntoto ke zikisaka ata fioti kimuntu ya bantu na kulombaka nge na kutula code na . Win + R to Nsiku ya macOS.
• Sadila Bafungula ya Lutaninu ya Bima (YubiKey) to Bafungula ya Kukota + Lomba Kundimisa Diaka Sambu na Bisalu ya Mfunu: Na ntangu ba cookies ya session yina bo me yiba ke lutaka ba nsangu ya ntete ya kukota, ba plateforme ya nene (Google, GitHub, Cloudflare, AWS, Coinbase) ke salaka nde bo ndima nge diaka. yo ke lombaka nde bo bula FIDO2 YubiKey na kinsuni to bo sala check biométrique ya Passkey na ntwala ya kupesa nzila na konso muntu yina kele ti cookie ya session na kusoba mot de passe, kutinda bansangu, to kuyika adresi ya kukatula mbongo.
• Tala kana email na nge to mukanda ya miyibi me monana na Base de données de surveillance ya Darknet: Kota haveibeenpwned.com (yina ke tula ntangu yai bamilio ya ba adresi ya e-mail ya bantu yina bo me yiba mpi ba domaine yina bo me kotisa na kigonsa) mpi ke pesa nzila na bansangu ya ofele ya kufwa bansiku ya darknet sambu na ba adresi na nge ya e-mail.
• Katula ba téléchargements ya kukonda kutudila ntima, ba mods ya nsaka, mpi ba script ya bantu ya nkaka na kati ya Machine Virtuelle to Sandbox ya Windows: Kusala ve ata fioti kukonda kuzikisa .exe, .msi, .dmg, .bat, to Pithon pip / Node npm post-installer scripts mbala mosi na système d’exploitation ya host yina ke bumbaka ba session na nge ya navigateur web ya me ndimama mpi ba logins ya mbongo. Kangula Sandbox ya Windows (yina bo me tungaka na kati ya Windows 10/11 Pro mpi Enterprise na nzila ya Kangula to kanga bisadilu ya Windows > Sandbox ya Windows) to sadila masini mosi ya ntama yina kele ve ti ba cookies ya navigateur yina bo me bumbaka ntangu nge ke meka bisadilu ya nkaka.

Bangyufula yina bantu keyulaka mbala na mbala¶

Bantwadisi ya ke wakana¶

• Ba logiciel ya mbi, ba logiciel ya ransom, mpi ba logiciel ya espionage
• MFA phishing mpi kukonda nzila ya mbeni-na-kati-kati (AiTM)
• MFA lockout: mutindu ya kuvutula bakonti yina bo me kanga
• Bo me kotisa konti ya e-mail, bansiku ya kutinda, mpi kuvutula
• Cryptocurrency wallet drain and seed phrase compromise
• Password manager lockout and emergency vault recovery
• Emergency numbers directory

Bo me tala bisika yina bo me katuka¶

• Kimvuka ya ke talaka mambu ya lutaninu ya Internet mpi ya banzo ya nkaka (CISA) & FBI (États-Unis): Bandongisila ya ke tadila lutaninu ya Internet na kimvuka na yina me tala bisadilu ya mbi ya ke yibaka bansangu (LummaC2, RedLine, Rhadamanthys) mpi mutindu ya kufyotuna mutindu ya kuyiba bansangu (CSAE24 / MITRE ATT&CK Webs1539: Kuki ya lukutakanu).
• Institut National des Normes et de la Technologie (NIST) (États-Unis): NIST SP 800-63B: Bansiku ya Kuzaba Kimuntu ya Dijital: Kutwadisa Kilumbu, Kundimisa Diaka, mpi Kukanga Bifwanisu.
• Kimvuka ya Internet ya Nsi-Ntoto ya Mvimba (W3C) mpi Architecture ya Lutaninu ya Google Chromium: Bansiku ya Kusadila Bansangu ya Kusadila (DBSC) mpi Kukangama ya Kukangama na Ba-application ya Chrome (v20 DPAPI Kutombula) Mikanda ya Tekniki.
• Centre National de Sécurité Cybernétique (NCSC) (Royaume-Uni): Kufyotuna Baprograme ya Mbi, Bantu Yina Keyibaka Bansangu, mpi Kubotula Ba-Session na Ba-Entreprise mpi na Ba-Consommateur.
• Kangula Projet ya Lutaninu ya Ba Application ya Nsi-Ntoto ya Mvimba (OWASP): Mukanda ya Kukusa ya Kutwadisa Balukutakanu & Bansiku ya Kukatula Ba Token ya OAuth 2.0 (RFC 7009).