Dibutula dia tshimanyishilu tshia tshisangilu, Infostealer malware, ne dijimija dia tshisangilu tshia pa buloba bujima¶

Paudi umona ne: muntu udi ukubunda udi anu muele malu a tshinyangu a makuta a tshiamu tshia nzembu mu konte webe wa YouTube, Instagram, Discord anyi X, muenze mikenji ya dituma dia bintu mu kazubu kebe ka Gmail anyi Microsoft 365, anyi mubuele mu tshiamu tshiebe tshia mudimu tshia mu matutu kayi muanji kuenza mudimu ne code wa 2FA mu telefone webe anyi dimanyisha dia e-mail dia "New Login" ** ntshimanyinu tshia ** Token /Token Dikuata (Pass-the-Cookie) difumina ku Infostealer Malware. Paudi ubuela mu kazubu ka tanda ya internet ne ufunda "Keep me signed in", serveur udi upatula cookie wa tshisangilu tshia HTTP anyi tshimanyinu tshia OAuth (bu mudi tshia Google SID / SAPISID, wa Microsoft ESTSAUTHPERSISTENT, anyi Discord's Authorization tshimanyinu) tshilama munda mua tshilaminu tshia malu a SQLite tshia tshiamu tshieba tshia ku Enternete.

Bisumbu bia bintu bidi binyanga bintu, bu mudi Lumma Stealer, RedLine, Vidar, Raccoon, StealC, RisePro, Rhadamanthys, ne Atomic macOS Stealer (AMOS), kabiena bindile pa ordinatere webe bu mudi bipupu bia kale to. Misangu ya bungi, udi umueneka bu tshiamu tshia manaya tshia dishima, tshiamu tshia mudimu tshinyanguke, tshiamu tshia "ClickFix" tshia PowerShell CAPTCHA tshia dishima, anyi PDF wa diambuluisha dia bafidi ba makuta, infostealer udi wenza mudimu mu muinshi mua sekonde 4, udi upatula Chrome, Edge, Brave anyi Firefox webe Cookies ne Login Data tshibutshilu tshia bintu mu lungenyi, utshibueja mu tshibutshilu tshieba tshia makuta a tshiamu tshia mashinyi, uteka tshilaminu tshia bintu ku tshiamu tshia Telegram anyi tshia C2, ne tshidi tshijimija nkayatshi. Padi muntu udi ukubunda ubueja bintu biebe bia tshisangilu tshiiba mu tshiamu tshia kutangila nabi malu (Multilogin, Dolphin{anty}, anyi Gologin), muena mudimu wa ku Enternete udi wela meji ne: muntu udi ukubunda udi ordinatere webe ukadi mujadikibue, ne udi upita bionso bibidi: mot de passe webe ne dianyisha diebe dia malu abidi.

Enza nunku mpindieu¶

1. Lekela kushintulula mêyi ebe a tshisokomenu mu ordinatere udi ne disama, diakamue umbusha ordinatere anyi Mac ku Wi-Fi ne umbusha tshiamu tshia Ethernet. Etshi ke tshilema tshia kumpala tshidi bantu badibu bakengesha benza: badi bamona ne: mbakuate Discord, Steam anyi Gmail wabu, basomba anu ku ordinatere udi ne disama edi, ne bafunda mêyi mapiamapia mu Chrome. Shi infostealer persistence loader nansha scheduled task utshidi wenza mudimu pa tshiamu atshi, neangate diakamue mot de passe yebe mipiamipia ne cookies mipiamipia ya session ne neyitume diakamue kudi muntu udi ukubunda. Enza 100 pa lukama ya dishintulula dia meyi eba a tshisokomenu ne dijimija dia tshisangilu ku telefone wa bianza mukezuke (pa data ya ku bianza anyi Wi-Fi mukezuke) anyi portable mukuabu udi kayi mulengejibue.
2. Umanye ne: kushintulula mot de passe nkayaku kakuena misangu yonso kunyangakaja cookies ya session miiba anyi tokens ya OAuth refresh to, udi ne bua kutua pa "Sign Out of All Sessions" NE kumbusha programe ya OAuth ya bantu bakuabu. Pa biamu bia mudimu bia bungi (ne ne Google udi kayi ne mikanda MultiLogin / issueToken OAuth endpoints anyi long-lived session tokens), anu kushintulula mot de passe webe anyi kushintulula 2FA kudi mua kushiya session tokens ya session secondaire anyi OAuth desktop tokens idiku ne muoyo pa kumbusha wewe muenze Global Session & Token Revocation idi itangila platforme mu tablo udi kuinshi eku.
3. Biwikala na tshiamu tshia cryptocurrency wallet extension (MetaMask, Phantom, Rabby, Trust Wallet, Coinbase Wallet, Exodus, Electrum) tshiteka pa ordinatere udi ne disama, enza mudimu ne telefone mukezuke mpindieu bua kufila makuta ebe mu tshiambilu tshipiatshipia tshia tshiamu tshia mashinyi. Infolog stealer udi ulama mikanda ya tshibutshilu (wallet automatiquement).Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn bua MetaMask) pamue ne meyi a tshisokomenu adibu balame mu tshikebelu tshiebe. Nansha mudi muntu udi ukubunda kayi muanji kulenga tshiamu tshieba tshia makuta, tshilaminu tshiebe tshia bintu tshidi mu tshisalu tshia darknet tshiindila tshiamu tshia GPU tshidi katshiyi ku Enternete. Enza cryptocurrency wallet drain ne seed phrase compromise kulombola diakamue.
4. Lama "Apex Identity Accounts" yebe (Email wa kumpala, Password Manager, Apple/Google Account, ne Corporate SSO) mu minite 10 ya kumpala. Ku telefone webe wa bianza mukezuke, kangula Google / Gmail webe wa kumpala (myaccount.google.com/device-activity) ne Microsoft (mysignins.microsoft.com) konte kumpala. Patuka mu bisangilu bionso bia ku biro, ushintulule mot de passe munene, tangila Settings > Forwarding and POP/IMAP ne Filters/Rules bua kumbusha mikenji yonso ya dituma dia e-mail misokoka idi muena tshinyangu muenze bua kusokoka e-mail ya dipingaja dia mot de passe kudi midimu mikuabu, ne tangila Passkeys ne biamu bia Authenticator bidibu bafunde.
5. Tangila tshilaminu tshieba tshia Windows Run tufungu, tshiamu tshia mudimu, ne malu a kale a PowerShell pikala matuku mashale aa muenze mudimu ne dîyi dia dishima dia "ClickFix" dia CAPTCHA (Win + R -> Ctrl + V). Umue wa ku bintu bidi bienda bikola lukasa lelu udi Cloudflare anyi Google CAPTCHA wa dishima udi umueneka pa dibeji dia ku Enternete udi ukuambila bua "Fina Win + R, fina Ctrl + V, ne fina Enter bua kujadika ne udi muntu" (udi wenza mudimu musokoka mshta.exe anyi powershell -w hidden -enc ... dîyi difunda mu tshibuta tshieba).
6. Ikala ne lungenyi luimpe ne ulame bukubi bua mubidi pikala dishipa dia mikenji ditangila nzubu ya mudimu anyi dikuata dia bintu bia bantu. Infostealer logs misangu ya bungi itu ifila mikanda ya dipikula anyi ya masandi idi ileja mot de passe webe muibe. Kufutshi bantu badi banyanga bintu nansha kakese; mona wetu dinyanga dia masandi ne dishima dia ku Enternete mulombodi, ne shi udi mupeta njiwu ya ku mubidi, udi mua kubikila nimero ya lukasa ya muaba unudi (911 mu États-Unis ne Canada, 112 mu Union européenne mujima, 999 mu Royaume-Uni, anyi tangila nimero wetu nomba ya tshimpitshimpi tshilaminu).

Infostealer & session cookie hijacking incident response decision tree¶

flowchart TD
    Root["Badi bela meji ne: mbakuate cookies anyi mbakuate bintu bibi bia Infostealer"] --> IsolatePC["MUSHINDU 1: Umbusha diakamue ordinatere/Mac udi ne disama edi ku Wi-Fi ne Ethernet (KUSHINTULULI mêyi a tshisokomenu adi ne disama edi to)"]

    IsolatePC --> CryptoCheck{"Kuvuaku bintu bia kukumbaja nabi tshibutshilu tshia makuta (MetaMask, Phantom, Exodus) pa ordinatere au anyi?"}
    CryptoCheck -->|"Eyowa"| EvacCrypto["Wenza mudimu ne telefone/tshibuta tshia bintu bia mudimu diakamue bua kukosa bintu bionso bia crypto mu tshiambilu tshipiatshipia tshia ntete"]
    CryptoCheck -->|"Tòo"| ApexLock["TSHINYI 2: Pa telefone wa bianza mukezuke, kanga e-mail wa kumpala (Gmail, Outlook, Proton) kumpala"]
    EvacCrypto --> ApexLock

    ApexLock --> GlobalRevoke["TSHITUPA 3: Enza tshisangilu tshia buloba bujima + tshimanyinu tshia OAuth + dijimija dia tshiamu tshia tshisokomenu mu konte yonso ya mushinga mukole (Tangila tshitupa tshia tshisanji tshidi kuinshi eku)"]

    GlobalRevoke --> ExportList["MUSHINDU 4: Pa tshiamu tshia mashinyi tshidi ne disama, patula liste wa meyi a tshisokomenu onso adibu balame ne cookies bua kumanya bimpe konte idibu bibe"]

    ExportList --> CleanOS["MUSHINDU 5: Kulama anu mikanda ya muntu nkayende -> Enza Clean OS Wipe/Install kabidi -> Re-re-passkeys & Enable Chrome App-Bound Encryption"]

Kumvua mudi Infostealers bapita 2FA ne DPAPI / Keychain encryption¶

Mmunyi mudi program wa 200-kilobyte mua kuiba meyi a tshisokomenu ne cookies ya tshisangilu idi Google Chrome, Microsoft Edge, ne Brave bafunda pa disque dur webe?

1. Windows DPAPI (CryptUnprotectData) ne Chrome App-Bound Encryption (v20):
2. Pa Windows, biamu bia Chromium (Chrome, Edge, Brave, Opera, Vivaldi) bidi bilama mêyi ebe a tshisokomenu adibu balame munda %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data ne bintu biebe bia tshisangilu munda \Network\Cookies.
3. Ma data a SQLite adi masokoka na AES-256-GCM master key mulama mu %LOCALAPPDATA%\Google\Chrome\User Data\Local State, udi mukubibue kudi Windows Data Protection API (DPAPI) mulamakaja ku konte webe wa Windows udi mubuele.
4. Bu muudi muenze mudimu ne infostealer bu muena mudimu webe wa Windows, mudimu wonso udi wenzeka muinshi mua konte webe wa muena mudimu udi mua kubikila CryptUnprotectData() bua kulomba Windows bua kupatula tshifungu. Ne bua kupita Chrome 127+ App-Bound Encryption (v20 mudimu wa tshibandilu), ba infostealers ba matuku etu aa batu bela buludiludi mu tshintu tshidi katshiyi ne mutu chrome.exe mushindu wa kujikija bilumbu (--remote-debugging-port) anyi wenze mudimu ne COM elevation bua kulomba Chrome nkayende bua kuela cookies yonso mifunda.
5. macOS Keychain & Atomic macOS Stealer (AMOS / PoseStealer):
6. Pa Apple macOS, ba infostealers badi badivuije bu .dmg (misangu ya bungi udi ukulomba bua "Kutua ku dia balume -> Kangula" anyi kukoka tshimfuanyi ku Terminal bua kupita Apple Gatekeeper) udi upatula kazubu ka dishima ka macOS kadi kafunda ne: "System Preferences udi musue kubuela mu malu ebe masokoka: Enter your Mac login password". Diakamue paudi ufunda mot de passe webe wa kubuela mu Mac mu tshikebelu atshi, script udi unzulula -/Library/Keychains/login.keychain-db ne udi ukopolola Safari/Chrome cookies, Apple Notes, ne iCloud tokens.
7. Google MultiLogin / OAuthLogin Token Regeneration Exploit:
8. Bakebuludi ba malu a bukubi mbaleje ne: bantu badi biba malu a ngumu kabatu anu biba cookies ya ku Enternete to, badi kabidi bapatula bintu bidi kabiyi ne mikanda oauth_token bimanyinu bia mudimu bia ku Chrome Web Data (token_service table) SQLite file. Nansha muntu mumane kushintulula meyi ende a tshisokomenu a Google musangu umua, bena tshinyangu badi mua kupingaja mêyi a tshisokomenu adibu bibe token_service Tshimanyinu tshia OAuth tshidi tshiluisha tshidi munda mua Google OAuthLogin ndekelu wa tshiamu tshia nzembu tshipiatshipia tshidi tshikumbane SID cookies ya browser pa kumbusha pikala muena mudimu mupatuke mu tshisangilu tshia tshiamu tshia Chrome tshivua tshinyanguke NE mumbushe tshiamu tshia OAuth tshia muntu mukuabu.

Tshitupa 1: Tshisangilu tshia pa buloba bujima, Cookie, OAuth, ne Passkey Revocation Matrix¶

Ku diambuluisha dia telefone wa bianza mukezuke anyi ordinatere mukezuke, enza mudimu ne mesa aa kumbukila kuulu too ne kuinshi. Malu adi atangila dilomba: enza misangu yonso Tshitupa A (Patuka mu bikondo bionso bidi bienza mudimu) ne Tshitupa B (Shintulula mot de passe) ne Tshitupa C (Audit 2FA/Passkeys/OAuth/Forwarding) pamue, wewe anu mushintulule mot de passe webe kuyi ujikija tshisangilu tshidi tshienza mudimu, browser udi wenza mudimu udi ushala mubuele ne udi mua kukutangila anyi kukusakidila mushindu wa dipingaja dia bintu bibi.

Tshitupa 2: Mushindu kayi wa kumanya konte yonso uvua mupatuke mu ordinatere webe udi ne disama edi¶

Paudi ujikija kukanga konte yebe 10 ya mushinga mukole mu telefone webe mukezuke, udi upeta lukonko lukole: "Ndi muenze mudimu ne ordinatere au bidimu binayi, mmunyi mundi mua kumanya pa site yanyi 250 ivua ne meyi a tshisokomenu anyi cookies mu Chrome/Edge pavua infostealer wenza mudimu?"

Paudi ulama ordinatere udi ne disama edi 100 pa lukama kayi wenza mudimu (Wi-Fi OFF, Ethernet mupatuke), umutemeshe ne upatule bintu biebe bia patoke kumpala kua kukupula tshiamu:

1. Patula liste wa meyi a tshisokomenu adibu balame mu tshikebelu tshiebe (CSV):
2. Kangula tshikebelu tshieba tshia ku Enternete (chrome://password-manager/settings mu Chrome, edge://wallet/settings mu Edge, anyi about:logins mu Firefox) ne tuaku pa Tuma meyi a tshisokomenu bua kulama Chrome Passwords.csv pa tshiamu tshia USB tshikezuke.
3. Bua tshinyi mukanda ewu udi wa or bua dipingaja diebe: Infostealer uvua muibe tshilaminu tshia malu etshi menemene. Kuikala ne Chrome Passwords.csv kumpala kuebe udi ukupesha liste mulelela wa dina dia mudimu ne meyi a tshisokomenu adi muntu udi ukubunda nawu mpindieu, bua wewe kubenga kujimija tshibuelelu tshia kale tshia bitadi, konte wa kilometre ya ndeke, anyi site wa dipanyishila bintu udi ne karte ka mfranga kalama.
4. Tangila site idi ne Session Cookies (chrome://settings/content/all):
5. Mu Chrome anyi Edge (paudi kuyi ku Enternete), ndaku ku chrome://settings/content/all (anyi edge://settings/content/all) ne kulongolola bilondeshile Malu adibu balame anyi Malu adibu batamba kutangila. Diteba dionso diudi mushale mubuele kuyi mufunde mot de passe divua mua kuikala mu njiwu ya diiba dia cookies ne didi dijinga ne dijikija dia tshisangilu tshiadi.
6. Tangila ni Standalone Password Manager (1Password, Bitwarden, KeePassXC) uvua mubulula pa tshikondo tshia disama:
7. Bikala 1Password, Bitwarden, anyi KeePassXC tshilaminu tshieba tshikanga pavua infostealer wenza mudimu: Programe wa malu mabi uvua mua kuangata anu tshilaminu tshia muaba uvuabu balame (data.json anyi .kdbx), udi mukubibue kudi PBKDF2-SHA256 / Argon2id + Master Password webe (ne 34-character Secret Key mu 1Password). Shi mot de passe webe mukola, bintu bidi mu tshilaminu tshieba bidi bishala bimpa, nansha muudi anu ne tshia kushintulula mot de passe webe munene bua kudikuba.
8. Bikala tshintu tshieba tshia kulama natshi meyi a tshisokomenu tshivua tshiunzulula mu meji pavua programe wa tshinyangu au muenze mudimu (anyi wewe mulame meyi a tshisokomenu a mu tshilaminu tshieba tshia Chrome.): Fuanyikija ne: infostealer mmulekele tshibutshilu tshiebe anyi mmukuate tshibutshilu tshiebe tshinene, ne ushintulule malu onso adi ne mushinga adi mu tshibutshilu tshiebe.

Tshitupa 3: Kukeba ne kumbusha ditantamana dia Infostealer kumpala kua kubutula OS¶

Kumpala kua kuenza backup wa mikanda yebe ne kuenza mudimu wa dilongolola dia OS, udi mua kutangila mushindu uvua infostealer mubuele mu tshiamu tshiebe ne ni uvua mulekele tshintu tshibidi tshidi katshiyi tshijika (bu mudi mudimu mulongolola, Registry Run tshifungu, Tshibangidilu .lnk njila muipi, anyi tshintu tshibi tshia Chrome):

1. Enza Offline PowerShell Persistence Audit (Windows)¶

Fungula PowerShell (Admin) pa ordinatere udi kayi pa lutanda lua Internet ne wenze malu anayi aa a kubala anu:

# 1. Check the Windows Run/RunOnce Registry Keys for user-level malware loaders in AppData/Temp:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                       "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
                       "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue

# 2. Check the Startup Folder for suspicious .lnk, .vbs, .bat, or .exe files:
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
                    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force

# 3. List all Scheduled Tasks created or modified in the last 7 days calling PowerShell, cmd, mshta, or AppData:
Get-ScheduledTask | Where-Object { $_.State -ne "Disabled" } | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    foreach ($action in $_.Actions) {
        if ($action.Execute -match "powershell|cmd|mshta|wscript|cscript|rundll32|regsvr32|AppData|Temp|ProgramData") {
            [PSCustomObject]@{
                TaskName = $_.TaskName
                Execute  = $action.Execute
                Args     = $action.Arguments
                LastRun  = $info.LastRunTime
            }
        }
    }
} | Format-Table -AutoSize

# 4. Check Windows Defender Exclusions (Infostealers immediately add C:\ or AppData to Defender Exclusions.):
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath | ForEach-Object { Remove-MpPreference -ExclusionPath $_ }

2. Bua tshinyi mbimpe kupingaja OS mukezuke (ku diambuluisha dia USB Media) kunyima kua Infostealer¶

Patudi tuenza mudimu ne Microsoft Defender Offline Scan ne Malwarebytes kunyima kua diumusha dia Defender exclusions udi umbusha bintu bidi bimanyike, bena mudimu ba bintu batu misangu ya bungi basangisha tshintu tshibidi tshia RAT (Remote Access Trojan), SystemBC SOCKS5 proxy, anyi clipper malware Windows (tshidi tshipuekesha ne clipboard udi ushintulula adrese yonso wa tshibutshilu tshia Bitcoin/Ethereum ne adrese wa muena tshinyangu). - Wewe mumane kukopa mikanda yebe ya pa nkayebe, foto, ne Chrome Passwords.csv paudi kuyi mu ordinatere, enza Windows 11 USB Reinstall (anyi macOS Erase All Content and Settings) bilondeshile malu mabi, ransomware, ne spyware infection guide.

3. Kukonkonona biamu bia macOS ne Linux bua Infostealer Artifacts (Atomic macOS Stealer / AMOS, Poseidon, ne Malicious Browser Extensions)¶

Shi tshiamu tshiebe tshidi ne disama edi ntshia Apple MacBook/iMac anyi tshiamu tshia mudimu tshia bafidi ba ngenyi ba Linux pamutu pa tshiamu tshia Windows, enza mudimu ne biamu ebi bua kumanya ne kumbusha ditantamana:

# On Apple macOS:
# 1. Check for unauthorized LaunchAgents and LaunchDaemons dropped by AMOS / Poseidon Stealer:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

# 2. Check for hidden staging folders in /tmp or /var/folders created by AppleScript / osascript stealers:
find /tmp /var/folders -iname "*out.zip*" -o -iname "*passwords.txt*" -o -iname "*cookies*" 2>/dev/null

# 3. Inspect installed Chrome / Brave / Edge Extensions for rogue manifest permissions ('cookies', 'webRequest', '<all_urls>'):
grep -rn '"permissions"' ~/Library/Application\ Support/Google/Chrome/Default/Extensions/ 2>/dev/null

4. Enterprise & Cloud Admin Containment (Microsoft Entra ID, Okta, Google Workspace, ne AWS IAM)¶

Shi ordinatere udi ne disama dia infostealer uvua wa muenji wa programe, mulombodi wa DevOps, anyi muena mudimu wa kumpanyi uvua ne bikondo bia mudimu mu Microsoft Entra ID (Azure AD), Okta, Google Workspace, AWS, anyi Cloudflare, dilengeja dia tshiamu tshia mudimu didi anu tshitupa tshia mvita. Enza mudimu wa diumusha dia tshilaminu tshia matutu diakamue:

• Microsoft Entra ID (Revoke-MgUserSignInSession): Kufina pa "Sign out" mu tshikebelu tshimue kakuena misangu yonso kumbusha Primary Refresh Tokens (PRTs) anyi Azure CLI (az login / .azure/msal_token_cache.bin) bimanyinu bikopolola ku diske. Mulombodi wa Entra udi ne tshia kuenza mudimu Revoke-MgUserSignInSession -UserId user@company.com mu Microsoft Graph PowerShell bua kupingaja tshiakabidi tshia muena mudimu signInSessionsValidFromDateTime attribute ne invalidate Refresh Tokens yonso mu bitupa bionso bia ndekelu musangu umua.
• AWS CLI & Developer Token Rotation (-/.aws/credentials, -/.npmrc, -/.pypirc, -/.kube/config): Basumbishi ba bintu badi batangila patoke mukanda wa nzubu wa muntu yonso bua kupeta .aws/credentials, .ssh/id_ed25519, .gitconfig, .env, ne Docker/Kubernetes config files. Diakamue, jika ne ushintulule AWS IAM Access Keys yonso (AKIA...) mu AWS Console, kumbusha GitHub Personal Access Tokens (ghp_...), ne kujimija nshinga ya SSH idi mipatuke ku biamu bia mudimu (-/.ssh/authorized_keys).
• Desktop Messaging & VPN Client Token Purge (Telegram Desktop tdata, Signal, Slack, OpenVPN, WireGuard): Pa kumbusha biamu bia ku Enternete, biamu bia infostealer bidi bikopolola %APPDATA%\Telegram Desktop\tdata tshilaminu (tshidi tshianyishila muntu udi ukubunda bua kuenza clone wa konte webe mujima wa Telegram mu ordinatere wende kayi ne kode wa SMS), %APPDATA%\Slack\storage, ne mulame OpenVPN (.ovpn) / WireGuard (.conf) mishindu ya VPN ya kumpanyi. Kangula Telegram ku telefone webe (Malongolola > Biamu -> Kujikija bikondo bikuabu bionso), patuka mu miaba yonso ya mudimu ya Slack (slack.com/account/settings -> Patuka mu bikondo bikuabu bionso), ne lomba mulombodi wa tshisanji tshiebe bua kumbusha ne kupatula kabidi mukanda webe wa VPN wa mudimu.

Dikuba: Mushindu kayi wa kuenza bua tshikebelu tshieba ne konte yebe kayiyi mua kukuata kudi Infostealers¶

Padi tshiamu tshieba tshikezuke ne konte yebe mimane kupingajibua, enza mudimu ne malu atanu aa bua muivi wa ngumu kayi mua kukuata kabidi nsombelu webe wa ku Enternete to:

• KUENA mua kulama meyi a tshisokomenu munda mua tshiamu tshiebe tshia tshikebelu tshia ku Enternete (Chrome / Edge / Brave / Firefox Autofill) kuyi ne Hardware/Master Key: Muntu yonso udi wiba ngumu ya pa buloba udi utangila Chrome Login Data SQLite table kumpala. Tangila OFF "Dilomba dia kulama meyi a tshisokomenu" mu chrome://password-manager/settings ne ulame meyi ebe a tshisokomenu munda mua tshiamu tshia meyi a tshisokomenu tshidi katshiyi ne dimanya nansha dikese (1Password, Bitwarden, Proton Pass, anyi KeePassXC) tshilongolola bua Auto-Lock diakamue padi tshiamu tshikanga anyi panyima pa minite 5 ya tshikondo tshia tshianana.
• Enzeja "Device-Bound Session Credentials (DBSC)" & "App-Bound Encryption" mu Chrome 127+: Tangila ne: Google Chrome anyi Edge mbikale bipiabipia ne mbiteka mu tshilaminu tshia bintu bia mudimu (C:\Program Files\Google\Chrome\Application) nunku GoogleChromeElevationService udi mua kulamakaja tshisokomenu tshia cookie ku bipimu bia diakalenga dia tshiamu ne bia tshiamu tshia TPM ku diambuluisha dia Device-Bound Session Credentials (DBSC).
• Kukandika kazubu ka mudimu ka Windows (Win + R) anyi mshta.exe bua kupangisha "ClickFix" Fake CAPTCHA Attacks: Kufina ** nansha kakeseWin + R -> Ctrl + V -> Enter** padi kazubu ka CAPTCHA, tshiamu tshia Cloudflare tshia dishima, anyi "Fix Microphone / Fix Font" tshidi tshipatuka tshikulomba bua kuela dîyi mu Run dialog anyi Terminal, kakuena kazubu ka tanda ya internet ka pa buloba kadi mua kujadika bumuntu pa kukulomba bua kuela code mu Win + R anyi macOS Terminal.
• Wenza mudimu ne bintu bia bukubi (YubiKey) anyi bintu bia tshibuelelu + Lomba bua kujadika tshiakabidi bua malu adi ne mushinga: Nansha mudi bipese bia tshisangilu biiba bipita dilomba dia kumpala dia kubuela, biamu binene bia mudimu (Google, GitHub, Cloudflare, AWS, Coinbase) bidi bilomba **Step-Up-Step-Up (SteUp) tshienzelu tshia FIDO2 YubiKey anyi tshikebelu tshia biometric tshia Passkey kumpala kua kuanyishila muntu yonso udi ne cookie wa session bua kushintulula mot de passe webe, kutuma malu anyi kusakidila adrese wa dipatuka.
• Tangila ni e-mail webe anyi tshikandakanda tshia muivi tshidi tshimueneka mu Darknet Monitoring Databases: Tangila haveibeenpwned.com (udi mpindieu uleja miliyo ya adrese ya e-mail ya bantu badi bibe ne domaine idibu bashipe) ne udi ufila dimanyisha dia tshianana dia dishipa dia mikenji ya darknet bua adrese yebe ya e-mail.
• Kutapulula bintu bidi kabiyi bia kueyemena, mishindu ya manaya, ne script ya bantu bakuabu munda mua tshiamu tshia ordinatere anyi Windows Sandbox: Kuenza mudimu nansha kakese kayi mujadikibue .exe, .msi, .dmg, .bat, anyi Python pip / Node npm panyima pa diteka dia scripts buludiludi pa système d'exploitation wa host udi ulama bikondo biebe bia ku Enternete ne malu a mfranga. Ela Windows Sandbox (mu Windows 10/11 Pro ne Enterprise kupitshila ku Turn Windows features on or off > Windows Sandbox) anyi wenze mudimu ne tshiamu tshia pa nkaya tshidi katshiyi ne cookies ya browser milama padibu bateta bintu bia mudimu bia bantu bakuabu.

Nkonko itubu bela misangu ya bungi¶

Malu adi apetangana¶

• Disama dia programe mibi, ransomware, ne spyware
• MFA phishing ne Adversary-in-the-Middle (AiTM) bypass
• MFA lockout: mushindu kayi wa kupingaja konte mikanga
• Mukanda wa e-mail uvua munyanguke, mikenji ya dituma dia bintu, ne dipingaja dia bintu
• Cryptocurrency wallet drain ne seed phrase compromise
• Dikanga dia tshilaminu tshia meyi a tshisokomenu ne dipingaja dia tshilaminu tshia bintu mu tshimpitshimpi
• Mukanda wa nomba ya tshimpitshimpi

Miaba mifumina¶

• Cybersecurity and Infrastructure Security Agency (CISA) & FBI (United States): Joint Cybersecurity Advisories on Infostealer Malware (LummaC2, RedLine, Rhadamanthys) and Mitigating Token/Session Theft (CSAE24 / MITRE ATT&CK T1539: Steal Cookie Web Session & T1500500: Cookie).
• Tshilongelu tshia ditunga tshia mikenji ne bia mudimu (NIST) (États-Unis): NIST SP 800-63B: Mikenji ya dimanyisha dia ku Enternete: Dilombola dia tshisangilu, dijadika dia kabidi, ne dilamakaja dia bimanyinu.
• World Wide Web Consortium (W3C) & Google Chromium Security Architecture: Device Bound Session Credentials (DBSC) Specification and Chrome App-Bound Encryption (v20 DPAPI Elevation) Technical Documentation.
• Tshibambalu tshia bukubi tshia ku Enternete tshia ditunga (NCSC) (Royaume-Uni): Dikepesha dia malu mabi, diiba dia malu, ne dikuata dia bintu mu nzubu ya midimu ne ya bantu badi basumba bintu.
• Mudimu wa bukubi wa bintu bia mudimu bia pa buloba bujima (OWASP): Dibeji dia dishima dia dilombola dia tshisangilu ne mikenji ya dishipa dia tshimanyinu tshia OAuth 2.0 (RFC 7009).