Rampasan Token Sesi, Perisian Hasad Infostealer dan Pembatalan Sesi Global¶

Mendapati bahawa penyerang baru sahaja menyiarkan penipuan mata wang kripto daripada akaun YouTube, Instagram, Discord atau X anda, mencipta peraturan pemajuan dalam peti masuk Gmail atau Microsoft 365 anda atau mengakses konsol awan korporat anda tanpa mencetuskan kod 2FA pada telefon anda atau amaran e-mel "Log Masuk Baharu" ialah tandatangan yang tidak dapat disangkal bagi Session Cookie / Token Hijacking (Passtealer) Apabila anda log masuk ke tapak web dan menyemak "Kekalkan saya dilog masuk", pelayan mengeluarkan kuki sesi HTTP yang disulitkan atau token pembawa OAuth (seperti Google SID / SAPISID, milik Microsoft ESTSAUTHPERSISTENT, atau Discord's Authorization token) disimpan di dalam pangkalan data SQLite tempatan pelayar web anda.

Keluarga perisian hasad pencuri maklumat komoditi, termasuk Lumma Stealer, RedLine, Vidar, Raccoon, StealC, RisePro, Rhadamanthys dan Atomic macOS Stealer (AMOS), jangan tunggu di komputer anda seperti virus tradisional. Selalunya menyamar sebagai mod permainan palsu, pemasang perisian retak, gesaan PowerShell CAPTCHA palsu "ClickFix" atau PDF kerjasama penaja, pencuri maklumat melaksanakan dalam di bawah 4 saat, menyahsulit Chrome, Edge, Brave atau Firefox anda Cookies dan Login Data pangkalan data dalam ingatan, zipkannya dengan fail dompet cryptocurrency desktop anda, muat naik arkib ke pelayan Telegram atau C2 dan memadamkan dirinya sendiri. Apabila penyerang mengimport kuki sesi anda yang dicuri ke dalam penyemak imbas anti-pengesan (Multilogin, Dolphin{anty}, atau Gologin), pelayan web menganggap penyerang ialah komputer anda yang telah disahkan, memintas sepenuhnya kata laluan anda dan pengesahan dua faktor anda.

Lakukan ini sekarang¶

1. BERHENTI menukar kata laluan anda pada komputer yang dijangkiti, segera putuskan sambungan PC atau Mac itu daripada Wi-Fi dan cabut kabel Ethernetnya. Ini adalah kesilapan #1 yang dilakukan mangsa: mereka mendapati Discord, Steam atau Gmail mereka telah dirampas, duduk di komputer desktop yang dijangkiti yang sama dan menaip kata laluan baharu ke dalam Chrome. Jika pemuat kegigihan infostealer atau tugas berjadual masih aktif pada mesin itu, ia akan segera menangkap kata laluan baharu anda dan kuki sesi baharu dan menghantarnya kembali kepada penyerang. Lakukan 100 peratus daripada perubahan kata laluan anda dan pembatalan sesi daripada telefon pintar yang bersih (pada data selular atau Wi-Fi bersih) atau komputer riba yang berasingan dan tidak disentuh.
2. Fahami bahawa menukar kata laluan sahaja TIDAK selalu membatalkan kuki sesi yang dicuri atau token muat semula OAuth, anda MESTI secara eksplisit mengklik "Log Keluar Dari Semua Sesi" DAN membatalkan apl OAuth pihak ketiga. Pada beberapa platform (dan dengan Google yang tidak didokumenkan MultiLogin / issueToken Titik akhir OAuth atau token sesi tahan lama), hanya menukar kata laluan anda atau memutar 2FA boleh membiarkan token sesi kedua atau token desktop OAuth sedia ada hidup melainkan anda melaksanakan langkah Sesi Global & Pembatalan Token dalam jadual di bawah.
3. Jika anda mempunyai sambungan dompet mata wang kripto perisian (MetaMask, Phantom, Rabby, Trust Wallet, Coinbase Wallet, Exodus, Electrum) dipasang pada komputer yang dijangkiti, gunakan telefon yang bersih sekarang untuk memindahkan dana anda ke frasa benih dompet perkakasan serba baharu. Log Infostealer menuai fail peti besi yang disulitkan secara automatik (Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn untuk MetaMask) di samping kata laluan yang disimpan pelayar anda. Walaupun penyerang belum menyentuh kripto anda, fail peti besi anda sudah berada di pasaran darknet menunggu pemecah GPU luar talian. Laksanakan kami longkang dompet mata wang kripto dan kompromi frasa benih panduan segera.
4. Lindungi "Akaun Identiti Apex" anda (E-mel Utama, Pengurus Kata Laluan, Akaun Apple/Google dan SSO Korporat) dalam 10 minit pertama. Pada telefon pintar bersih anda, buka Google / Gmail utama anda (myaccount.google.com/device-activity) dan Microsoft (mysignins.microsoft.com) akaun dahulu. Log keluar semua sesi desktop, putar kata laluan induk, semak Tetapan > Pemajuan dan POP/IMAP dan Penapis/Peraturan untuk memadam sebarang peraturan pemajuan e-mel tersembunyi yang dibuat oleh penyerang untuk menyembunyikan e-mel penetapan semula kata laluan daripada perkhidmatan lain dan semak Kunci Laluan dan peranti Pengesah yang didaftarkan.
5. Audit Windows Registry anda Run kunci, Penjadual Tugas dan sejarah PowerShell jika anda baru-baru ini menjalankan perintah CAPTCHA palsu "ClickFix" (Win + R -> Ctrl + V). Salah satu vektor pencuri maklumat yang paling pesat berkembang hari ini ialah Cloudflare palsu atau Google CAPTCHA pop timbul pada halaman web yang mengarahkan anda untuk "Tekan Win + R, tekan Ctrl + V, dan tekan Enter untuk mengesahkan anda adalah manusia" (yang secara senyap melaksanakan perintah tersembunyi mshta.exe atau powershell -w hidden -enc ... arahan disalin ke papan keratan anda).
6. Kekalkan perspektif dan lindungi keselamatan fizikal jika pelanggaran melibatkan infrastruktur korporat atau peras ugut. Log infostealer kerap mencetuskan e-mel tebusan automatik atau sextortion yang memetik kata laluan anda yang dicuri. Jangan sekali-kali membayar peras ugut; lihat kami sextortion dan ugut dalam talian panduan, dan jika anda pernah menghadapi ancaman fizikal, hubungi nombor kecemasan tempatan anda (911 di Amerika Syarikat dan Kanada, 112 di seluruh Kesatuan Eropah, 999 di United Kingdom, atau lihat kami nombor kecemasan direktori).

Pepohon keputusan tindak balas insiden rampasan kuki infostealer & sesi¶

flowchart TD
    Root["Rampasan Kuki Sesi yang disyaki atau Jangkitan Perisian Hasad Infostealer"] --> IsolatePC["LANGKAH 1: Segera Putuskan Sambungan PC/Mac yang Dijangkiti daripada Wi-Fi & Ethernet (JANGAN Tukar Kata Laluan pada PC yang Dijangkiti)"]

    IsolatePC --> CryptoCheck{"Adakah Sebarang Sambungan Dompet Crypto (MetaMask, Phantom, Exodus) pada PC Itu?"}
    CryptoCheck -->|"ya"| EvacCrypto["Gunakan Dompet Telefon/Perkakasan yang Bersih dengan Segera untuk Menyapu Semua Aset Kripto kepada Frasa Benih Jenama"]
    CryptoCheck -->|"Tidak"| ApexLock["LANGKAH 2: Pada Telefon Pintar Bersih, Kunci E-mel Utama (Gmail, Outlook, Proton) Dahulu"]
    EvacCrypto --> ApexLock

    ApexLock --> GlobalRevoke["LANGKAH 3: Laksanakan Sesi Global + Token OAuth + Pembatalan Kunci Laluan Merentas Semua Akaun Kritikal (Lihat Matriks Platform Di Bawah)"]

    GlobalRevoke --> ExportList["LANGKAH 4: Pada PC Luar Talian yang Dijangkiti, Eksport Senarai Semua Kata Laluan & Kuki Penyemak Imbas yang Disimpan untuk Mengetahui Akaun Yang Dicuri dengan Tepat"]

    ExportList --> CleanOS["LANGKAH 5: Sandarkan Dokumen Peribadi Sahaja -> Lakukan Bersihkan OS/Pasang Semula -> Daftar Semula Kunci Laluan & Dayakan Penyulitan Terikat Apl Chrome"]

Memahami cara Infostealers memintas 2FA dan DPAPI / Penyulitan Rantai Kunci¶

Bagaimanakah program 200 kilobait boleh mencuri kata laluan dan kuki sesi yang disulitkan oleh Google Chrome, Microsoft Edge dan Brave pada pemacu keras anda?

1. Windows DPAPI (CryptUnprotectData) dan Penyulitan Terikat Apl Chrome (v20):
2. Pada Windows, penyemak imbas berasaskan Chromium (Chrome, Edge, Brave, Opera, Vivaldi) menyimpan kata laluan anda yang disimpan di dalam %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data dan kuki sesi anda di dalam \Network\Cookies.
3. Pangkalan data SQLite ini disulitkan dengan kunci induk AES-256-GCM yang disimpan dalam %LOCALAPPDATA%\Google\Chrome\User Data\Local State, yang dilindungi oleh Windows Data Protection API (DPAPI) yang terikat pada akaun pengguna Windows log masuk anda.
4. Oleh kerana anda menjalankan infostealer sebagai pengguna Windows log masuk anda sendiri, sebarang proses yang dijalankan di bawah akaun pengguna anda secara sejarah boleh memanggil CryptUnprotectData() untuk meminta Windows menyahsulit kunci. Dan untuk memintas Chrome 127+ App-Bound Encryption (v20 perkhidmatan lif), pencuri maklumat moden menyuntik terus ke dalam tanpa kepala chrome.exe proses penyahpepijatan (--remote-debugging-port) atau gunakan ketinggian COM untuk meminta Chrome sendiri membuang semua kuki yang dinyahsulit secara langsung.
5. MacOS Keychain & Atomic macOS Stealer (AMOS / PoseStealer):
6. Pada macOS Apple, pencuri maklumat menyamar sebagai .dmg muat turun (sering meminta anda untuk "Klik kanan -> Buka" atau seret ikon ke Terminal untuk memintas Apple Gatekeeper) muncul kotak dialog macOS asli palsu membaca "Keutamaan Sistem mahu mengakses maklumat sulit anda: Masukkan kata laluan log masuk Mac anda". Sebaik sahaja anda menaip kata laluan log masuk Mac anda ke dalam gesaan itu, skrip dibuka -/Library/Keychains/login.keychain-db dan menyalin kuki Safari/Chrome, Apple Notes dan token iCloud.
7. Google MultiLogin / OAuthLogin Eksploitasi Penjanaan Semula Token:
8. Penyelidik keselamatan mendedahkan bahawa pencuri maklumat bukan sahaja mencuri kuki web standard, mereka juga mengekstrak tanpa dokumen oauth_token token perkhidmatan daripada Chrome Web Data (token_service jadual) Fail SQLite. Walaupun selepas mangsa menukar kata laluan Google mereka sekali, penyerang boleh memainkan semula yang dicuri sebelum ini token_service Token OAuth terhadap dalaman Google OAuthLogin titik akhir kepada pudina serba baharu sah SID kuki penyemak imbas melainkan pengguna secara eksplisit melog keluar sesi peranti Chrome yang terjejas DAN membatalkan akses peranti pihak ketiga/OAuth.

Langkah 1: Sesi Global, Kuki, OAuth dan Matriks Pembatalan Kunci Laluan¶

Menggunakan telefon pintar yang bersih atau komputer kedua yang bersih, kerjakan jadual tepat ini dari atas ke bawah. Perkara pesanan: sentiasa lakukan Langkah A (Log keluar semua sesi/peranti yang aktif) dan Langkah B (Tukar kata laluan) dan Langkah C (Audit 2FA/Kunci Laluan/OAuth/Pemajuan) bersama-sama, jika anda hanya menukar kata laluan anda tanpa menamatkan sesi aktif, penyerang menambahkan kaedah dan penyemak imbas secara langsung boleh memerhati anda log pemulihan atau penyemak imbas secara langsung.

Step 2: How to find out EVERY account that was exposed on your infected computer¶

After you have locked down your top 10 critical accounts on your clean phone, you face a daunting question: "I have used that computer for four years, how do I know which of my 250 websites had saved passwords or active cookies inside Chrome/Edge when the infostealer ran?"

While keeping the infected computer 100 percent offline (Wi-Fi OFF, Ethernet unplugged), turn it on and extract your exact exposure inventory before wiping the machine:

1. Export your Browser Saved Passwords List (CSV):
2. Open your browser offline (chrome://password-manager/settings in Chrome, edge://wallet/settings in Edge, or about:logins in Firefox) and click Export passwords to save Chrome Passwords.csv onto a clean USB flash drive.
3. Why this file is gold for your recovery: The infostealer stole this exact database. Having Chrome Passwords.csv in front of you gives you the exact checklist of every single website username and password the attacker now possesses, so you don't miss an old tax portal, airline miles account, or shopping site with a saved credit card.
4. Inspect which websites had active Session Cookies (chrome://settings/content/all):
5. In Chrome or Edge (while offline), go to chrome://settings/content/all (atau edge://settings/content/all) and sort by Data stored or Most visited. Any website where you stayed logged in without typing a password was vulnerable to session cookie theft and needs its session terminated.
6. Check if your Standalone Password Manager (1Password, Bitwarden, KeePassXC) was Unlocked at the Moment of Infection:
7. If your 1Password, Bitwarden, or KeePassXC vault was LOCKED when the infostealer ran: The malware could only grab the encrypted local vault cache (data.json atau .kdbx), which is protected by PBKDF2-SHA256 / Argon2id + your Master Password (and 34-character Secret Key in 1Password). If your Master Password is strong, your vault contents remain safe, though you should still rotate your Master Password as a precaution.
8. If your password manager browser extension was UNLOCKED in memory when the malware ran (or if you saved your Password Manager Master Password inside Chrome's built-in autofill.): Assume the infostealer dumped your vault or captured your Master Password, and rotate all critical credentials inside your vault.

Step 3: Hunting and eradicating Infostealer persistence before wiping the OS¶

Before backing up your personal documents and performing a clean OS reinstall, you can inspect how the infostealer entered your system and whether it dropped a persistent secondary loader (such as a Scheduled Task, Registry Run key, Startup .lnk shortcut, or malicious Chrome Extension):

1. Run this Offline PowerShell Persistence Audit (Windows)¶

Open PowerShell (Admin) on the offline PC and run these four read-only forensic checks:

# 1. Check the Windows Run/RunOnce Registry Keys for user-level malware loaders in AppData/Temp:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                       "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
                       "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue

# 2. Check the Startup Folder for suspicious .lnk, .vbs, .bat, or .exe files:
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
                    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force

# 3. List all Scheduled Tasks created or modified in the last 7 days calling PowerShell, cmd, mshta, or AppData:
Get-ScheduledTask | Where-Object { $_.State -ne "Disabled" } | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    foreach ($action in $_.Actions) {
        if ($action.Execute -match "powershell|cmd|mshta|wscript|cscript|rundll32|regsvr32|AppData|Temp|ProgramData") {
            [PSCustomObject]@{
                TaskName = $_.TaskName
                Execute  = $action.Execute
                Args     = $action.Arguments
                LastRun  = $info.LastRunTime
            }
        }
    }
} | Format-Table -AutoSize

# 4. Check Windows Defender Exclusions (Infostealers immediately add C:\ or AppData to Defender Exclusions.):
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath | ForEach-Object { Remove-MpPreference -ExclusionPath $_ }

2. Why a Clean OS Reinstall (via USB Media) is Recommended After an Infostealer¶

While running Microsoft Defender Offline Scan and Malwarebytes after clearing Defender exclusions removes known persistence loaders, commodity infostealers frequently bundle a secondary RAT (Remote Access Trojan), SystemBC SOCKS5 proxy, or clipper malware (which silently monitors your Windows clipboard and swaps any copied Bitcoin/Ethereum wallet address with the hacker's address). - Once you have copied your personal documents, photos, and Chrome Passwords.csv off the offline PC, perform a clean Windows 11 USB Reinstall (or macOS Erase All Content and Settings) following our perisian hasad, perisian tebusan dan panduan jangkitan perisian intip.

3. Auditing macOS and Linux Systems for Infostealer Artifacts (Atomic macOS Stealer / AMOS, Poseidon, and Malicious Browser Extensions)¶

If your infected machine is an Apple MacBook/iMac or a Linux developer workstation rather than a Windows PC, run these offline terminal checks to detect and eradicate persistence:

# On Apple macOS:
# 1. Check for unauthorized LaunchAgents and LaunchDaemons dropped by AMOS / Poseidon Stealer:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

# 2. Check for hidden staging folders in /tmp or /var/folders created by AppleScript / osascript stealers:
find /tmp /var/folders -iname "*out.zip*" -o -iname "*passwords.txt*" -o -iname "*cookies*" 2>/dev/null

# 3. Inspect installed Chrome / Brave / Edge Extensions for rogue manifest permissions ('cookies', 'webRequest', '<all_urls>'):
grep -rn '"permissions"' ~/Library/Application\ Support/Google/Chrome/Default/Extensions/ 2>/dev/null

4. Enterprise & Cloud Admin Containment (Microsoft Entra ID, Okta, Google Workspace, and AWS IAM)¶

If the computer infected by an infostealer belonged to a software engineer, DevOps administrator, or corporate employee who had active sessions in Microsoft Entra ID (Azure AD), Okta, Google Workspace, AWS, or Cloudflare, local device cleanup is only half the battle. Execute these cloud directory revocations immediately:

• Microsoft Entra ID (Revoke-MgUserSignInSession): Clicking "Sign out" in a single browser does not always revoke Primary Refresh Tokens (PRTs) or Azure CLI (az login / .azure/msal_token_cache.bin) tokens copied from disk. An Entra Administrator must run Revoke-MgUserSignInSession -UserId user@company.com in Microsoft Graph PowerShell to reset the user's signInSessionsValidFromDateTime attribute and invalidate all Refresh Tokens across all endpoints simultaneously.
• AWS CLI & Developer Token Rotation (-/.aws/credentials, -/.npmrc, -/.pypirc, -/.kube/config): Commodity infostealers explicitly scan every user's home directory for .aws/credentials, .ssh/id_ed25519, .gitconfig, .env, and Docker/Kubernetes config files. Immediately deactivate and rotate all AWS IAM Access Keys (AKIA...) in the AWS Console, revoke GitHub Personal Access Tokens (ghp_...), and delete exposed SSH public keys from production servers (-/.ssh/authorized_keys).
• Desktop Messaging & VPN Client Token Purge (Telegram Desktop tdata, Signal, Slack, OpenVPN, WireGuard): Beyond web browsers, infostealer modules specifically copy the %APPDATA%\Telegram Desktop\tdata directory (which allows an attacker to clone your entire Telegram account onto their PC without an SMS code), %APPDATA%\Slack\storage, and saved OpenVPN (.ovpn) / WireGuard (.conf) corporate VPN profiles. Open Telegram on your phone (Settings > Devices -> Terminate All Other Sessions), sign out all Slack workspaces (slack.com/account/settings -> Sign out all other sessions), and ask your network administrator to revoke and reissue your corporate VPN client certificate.

Prevention: How to make your browser and accounts resistant to Infostealers¶

Once your system is clean and your accounts are recovered, implement these five defenses so an infostealer can never hijack your digital life again:

• NEVER store passwords inside your web browser's built-in password manager (Chrome / Edge / Brave / Firefox Autofill) without a Hardware/Master Key: Every commodity infostealer on Earth targets Chrome's Login Data SQLite table first. Turn OFF "Offer to save passwords" in chrome://password-manager/settings and store your passwords inside a dedicated, zero-knowledge password manager (1Password, Bitwarden, Proton Pass, or KeePassXC) configured to Auto-Lock immediately when the system locks or after 5 minutes of idle time.
• Enable "Device-Bound Session Credentials (DBSC)" & "App-Bound Encryption" in Chrome 127+: Make sure Google Chrome or Edge is updated to the latest version and installed in the default system directory (C:\Program Files\Google\Chrome\Application) so the GoogleChromeElevationService can bind cookie encryption to system privilege levels and TPM hardware keys via Device-Bound Session Credentials (DBSC).
• Disable the Windows Run Box (Win + R) or mshta.exe to block "ClickFix" Fake CAPTCHA Attacks: Never press Win + R -> Ctrl + V -> Enter when a website CAPTCHA, fake Cloudflare screen, or "Fix Microphone / Fix Font" pop-up asks you to paste a command into your Run dialog or Terminal, no legitimate website on Earth ever verifies humanity by asking you to paste code into Win + R or macOS Terminal.
• Use Hardware Security Keys (YubiKey) or Passkeys + Require Re-Authentication for Sensitive Actions: While stolen session cookies bypass initial login prompts, major platforms (Google, GitHub, Cloudflare, AWS, Coinbase) enforce Step-Up Authentication (Sudo Mode) requiring a physical FIDO2 YubiKey tap or Passkey biometric check before allowing anyone with a session cookie to change your password, export data, or add a withdrawal address.
• Check if your email or stealer log has appeared on Darknet Monitoring Databases: Visit haveibeenpwned.com (which now indexes millions of stealer log victim email addresses and compromised domains) and enable free darknet breach notifications for your email addresses.
• Isolate untrusted downloads, game mods, and third-party scripts inside a Virtual Machine or Windows Sandbox: Never run unverified .exe, .msi, .dmg, .bat, or Python pip / Node npm post-install scripts directly on the host operating system that holds your authenticated web browser sessions and financial logins. Enable Windows Sandbox (built into Windows 10/11 Pro and Enterprise via Turn Windows features on or off > Windows Sandbox) or use an isolated virtual machine with zero saved browser cookies when testing third-party utilities.

Soalan lazim¶

Panduan berkaitan¶

• Malware, ransomware, and spyware infection
• Pancingan data MFA dan pintasan Adversary-in-the-Middle (AiTM).
• MFA lockout: how to recover locked accounts
• Email account hacked, forwarding rules, and recovery
• Kekosongan dompet mata wang kripto dan kompromi frasa benih
• Password manager lockout and emergency vault recovery
• Direktori nombor kecemasan

Sumber disemak¶

• Cybersecurity and Infrastructure Security Agency (CISA) & FBI (United States): Joint Cybersecurity Advisories on Infostealer Malware (LummaC2, RedLine, Rhadamanthys) and Mitigating Token/Session Theft (CSAE24 / MITRE ATT&CK T1539: Steal Web Session Cookie & T1550.004: Web Session Cookie).
• National Institute of Standards and Technology (NIST) (United States): NIST SP 800-63B: Digital Identity Guidelines: Session Management, Reauthentication, and Token Binding.
• World Wide Web Consortium (W3C) & Google Chromium Security Architecture: Device Bound Session Credentials (DBSC) Specification and Chrome App-Bound Encryption (v20 DPAPI Elevation) Technical Documentation.
• National Cyber Security Centre (NCSC) (United Kingdom): Mitigating Malware, Infostealers, and Session Hijacking in Enterprise and Consumer Environments.
• Open Worldwide Application Security Project (OWASP): Session Management Cheat Sheet & OAuth 2.0 Token Revocation (RFC 7009) Standards.