Gufata ikimenyetso c'ikiganiro, Infostealer Malware, no gukuraho ikiganiro kw'isi yose¶

Kumenya ko umuterabwoba yashizeho ubuhendanyi bw’amahera y’imbere mu gihugu avuye kuri konti yawe ya YouTube, Instagram, Discord, canke X, yashizeho amategeko yo gurungika amakuru mu gasandugu kawe ka Gmail canke ka Microsoft 365, canke yinjiye mu gikoresho cawe co mu gicu c’ishirahamwe ata n’umwe yigeze atera kode ya 2FA kuri telefone yawe canke “Injira nshasha” y’imburi y’iposita ** (Guca-kuki) bitewe na Iporogarama mbi y'abasuma. Iyo winjiye ku rubuga maze ugasuzuma "Ngumye winjiye", umukozi atanga amakuru y'igihe ca HTTP canke ikimenyetso c'umurongo wa OAuth (nk'ica Google SID / SAPISID, vya Microsoft ESTSAUTHPERSISTENT, canke ivya Discord Authorization token) ibitswe imbere mu mucukumbuzi wawe w'urubuga rwa SQLite.

Imiryango y’ibikoresho bibi vy’ububisha bw’ibicuruzwa, harimwo Ubusuma bwa Lumma, RedLine, Vidar, Raccoon, UbusumaC, RisePro, Rhadamanthys, n’Ubusuma bw’Atomic macOS (AMOS), ntimurindire hirya no hino kuri mudasobwa yawe nk’ama virusi asanzwe. Akenshi yiyoberanije nk'umukino w'ikinyoma, uwushiramwo porogarama yasambutse, ikinyoma "ClickFix" PowerShell CAPTCHA, canke umuterankunga w'ubufatanye PDF, umusuma w'amakuru akora mu munsi y'amasegonda 4, akuraho Chrome yawe, Edge, Brave, canke Firefox Cookies na Login Data databases mu bubiko, ukazipfuka n'amadosiye yawe y'amahera y'ibanga, ugashira ububiko kuri server ya Telegram canke C2, maze ikayifuta. Igihe umuterabwoba yinjije amakuru yawe yibwe mu mucukumbuzi arwanya gutahura (Multilogin, Dolphin{anty}, canke Gologin), umukozi w’urubuga yiyumvira ko uwugutera ari mudasobwa yawe isanzwe yemejwe, akarenga burundu ijambobanga ryawe n’ukwemeza kwawe kw’ibintu bibiri.

Ivyo ubikore ubu¶

1. HAGANIKA guhindura amajambo y’ibanga yawe kuri mudasobwa yanduye, uce ubwo nyene ukura iyo PC canke Mac kuri Wi-Fi maze ukureho umugozi wayo wa Ethernet. Iri ni ryo kosa #1 abashikiwe n’ivyago bakora: babona ko Discord, Steam, canke Gmail yabo yanyazwe, bakicara kuri iryo jambo nyene ryanduye ry’umugera Chro. Iyo infostealer persistence loader canke igikorwa categekanijwe kigikora kuri iyo mashini, kizoca gifata amajambo y’ibanga yawe mashasha n’amakuru yawe mashasha y’ikiganiro maze kikabirungikira uwo muterabwoba. Kora 100 kw’ijana vy’uguhindura ijambobanga ryawe n’ugukuraho ibikorwa vyawe ukoresheje telefone ngendanwa isukuye (ku makuru y’amatelefone ngendanwa canke Wi-Fi isukuye) canke laptop itandukanye, itakozweko.
2. Tahura ko guhindura ijambobanga ryonyene BITAHORA bihindura ubusa amakuru y'ibiganiro vyibwe canke ibimenyetso vy'ugusubiramwo OAuth, UTEGEREZWA gukanda "Sohoka mu biganiro vyose" NO gukuraho porogaramu za OAuth z'uwundi muntu. Ku mbuga nyinshi (kandi n'ivyo Google yahinduye MultiLogin / issueToken OAuth endpoints canke ibimenyetso vy'igihe kirekire), guhindura gusa ijambobanga ryawe canke guhindura 2FA bishobora gusiga ibimenyetso vy'igihe ca kabiri canke ibimenyetso vy'ibiro vya OAuth biriho kiretse ushitse ku ntambwe zijanye n'urubuga Global Session & Token Revocation ziri mu mbonerahamwe iri musi.
3. **Niba ufise porogarama y’amahera y’ibanga (MetaMask, Phantom, Rabby, Trust Wallet, Coinbase Wallet, Exodus, Electrum) ishizwe kuri mudasobwa yanduye, koresha telefone isukuye ubu nyene kugira ngo ushire amahera yawe mu gikoresho gishasha c’amahera y’ibanga. dosiye (Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn ku MetaMask) iruhande y'amajambobanga yabitswe n'umucukumbuzi wawe. Naho uwo muterabwoba atarakora kuri crypto yawe, dosiye yawe y’ububiko irasanzwe yicaye ku isoko ry’umwiza irindiriye umunyagihugu atari mu murongo wa GPU. Gushitsa ivyacu cryptocurrency igikapu c'amazi n'imbuto y'amajambo yo gusenyera ku mugozi umwe kuyobora ubwo nyene.
4. Ukingire "Konti zawe z'akaranga za Apex" (Imeyili y'ibanze, Umucungerezi w'ijambobanga, Konti ya Apple/Google, na SSO y'ishirahamwe) mu minota 10 ya mbere. Kuri telefone yawe y'isuku, fungura Google / Gmail yawe ya mbere (myaccount.google.com/device-activity) na Mikorosofuti (mysignins.microsoft.com) amakonti mbere. Sohoka mu biganiro vyose vyo kuri mudasobwa, uhindure ijambobanga ry’ingenzi, usuzume Ivyagezwe > Gurungika na POP/IMAP na Ivyunguruzo/Amategeko kugira ngo usibe amategeko yose y’ugurungika imeyili yihishije umuterabwoba yaremye kugira ngo ahishe imeyili zisubiramwo ijambobanga zivuye mu zindi serivisi, kandi usuzume Passkeys na Authenticator zanditswe.
5. Gusuzuma ivyandikano vyawe vya Windows Run imfunguruzo, Umuteguro w'Ibikorwa, n'amateka ya PowerShell nimba uherutse gukoresha "ClickFix" itegeko ry'ikinyoma rya CAPTCHA (Win + R -> Ctrl + V). Kimwe mu bikoresho vy'ububisha vyihuta cane muri iki gihe ni Cloudflare y'ikinyoma canke Google CAPTCHA igaragara kuri paji y'urubuga ikubwira "Kanda Win + R, kanda Ctrl + V, hanyuma ukande Enter kugira ngo usuzume ko uri umuntu" (ivyo bikaba bikora mu gacerere ikintu kinyegejwe mshta.exe canke powershell -w hidden -enc ... itegeko ryakopiwe ku rubaho rwawe).
6. Gukomeza kubona ibintu mu buryo bubereye kandi ukinge umutekano w’umubiri nimba ukurenga ku mategeko birimwo ibikorwa remezo vy’ishirahamwe canke ubusuma. Infostealer logs kenshi zituma habaho incungu canke sextortion emails zisubiramwo ijambobanga ryawe ryibwe. Ntukigere uriha abanyagihugu; reba ivyacu gusambana n'ugutera ubwoba kuri Internet guide, kandi niwaba warigeze guhura n’ikintu cogutera ubwoba ku mubiri, hamagara inomero y’ivyihutirwa yo mu karere kawe (911 muri Leta Zunze Ubumwe za Amerika no muri Kanada, 112 hirya no hino mu Bumwe bw’Uburaya, 999 mu Bwongereza, canke urabe inomero yacu inomero z'ivyihutirwa ububiko).

Infostealer & igice c'ibifungurwa vy'ugufata inyishu y'igiti c'ingingo¶

flowchart TD
    Root["Bikekwaho kwiba ama cookie y'ikiganiro canke Infostealer kwanduzwa na porogaramu mbi"] --> IsolatePC["INTAMBWE YA 1: Ubwo nyene ushire PC/Mac yanduye kuri Wi-Fi & Ethernet (NTUHINDURE amajambo banga kuri PC yanduye)"]

    IsolatePC --> CryptoCheck{"Mbega Hariho Ivyuma Vyongereweko (MetaMask, Phantom, Exodus) Kuri Iyo PC?"}
    CryptoCheck -->|"Ego"| EvacCrypto["Koresha Telefone/Igikapu c'Ivyuma Gisukuye Ubwo nyene kugira ngo Ukure Itunga Ryose Rya Crypto ku Nvugo y'Imbuto Nshasha"]
    CryptoCheck -->|"Oya"| ApexLock["INTAMBWE YA 2: Kuri telefone ngendanwa isukuye, ubanza gufunga imeyili y'ibanze (Gmail, Outlook, Proton)"]
    EvacCrypto --> ApexLock

    ApexLock --> GlobalRevoke["INTAMBWE YA 3: Gushitsa Igihe c’Isi Yose + Ikimenyetso ca OAuth + Gukuraho Urufunguzo rw’Ibanga Ku Makonti Yose Ahambaye (Raba Igishushanyo c’Ikibanza kiri Hasi)"]

    GlobalRevoke --> ExportList["INTAMBWE YA 4: Kuri PC yanduye itari ku murongo, Sohereza hanze urutonde rw'amajambobanga yose yabitswe n'amakuru y'umucukumbuzi kugira ngo umenye neza amakonti yibwe"]

    ExportList --> CleanOS["INTAMBWE YA 5: Gusubiza inyuma inyandiko z'umuntu ku giti ciwe gusa -> Gukora OS Isukuye Gukuraho/Gusubira gushiramwo -> Gusubira kwandika Passkees & Gushoboza Chrome App-Bound Encryption"]

Gutahura ingene abasuma b'amakuru barenga 2FA na DPAPI / ububiko bw'urufunguzo¶

Ni gute porogarama y’amakilobyte 200 ishobora kwiba amajambo y’ibanga n’amakuru y’ibanga Google Chrome, Microsoft Edge na Brave bishira kuri disiki yawe?

1. Idirisha DPAPI (CryptUnprotectData) na Chrome Porogaramu-Iboshe Ububiko (v20:
2. Kuri Windows, amashakisha ashingiye kuri Chromium (Chrome, Edge, Brave, Opera, Vivaldi) abika amajambo banga yawe yabitswe imbere %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data na cookies zawe z'ikiganiro imbere \Network\Cookies.
3. Izo nzira z’amakuru za SQLite zifise urufunguzo rwa AES-256-GCM rubitswe muri . %LOCALAPPDATA%\Google\Chrome\User Data\Local State, irindwa na API yo kurinda amakuru ya Windows (DPAPI) iboshe kuri konti yawe y’ukoresha ya Windows yinjiye.
4. Kubera ko wakoresheje infostealer nk'umukoresha wawe bwite wa Windows, igikorwa cose gikoreshwa munsi ya konti yawe y'ukoresha coshobora guhamagara CryptUnprotectData() kugira ngo usabe Windows gufungura urufunguzo. Kandi kugira ngo unyure Chrome 127+ Ububiko bushingiye kuri porogaramu (v20 asanseri), abasuma b’amakuru bo muri iki gihe batera inshinge mu buryo butaziguye mu muntu atagira umutwe chrome.exe uburyo bwo gukosora (--remote-debugging-port) canke ukoreshe COM elevation kugira ngo usabe Chrome ubwayo guta amakuru yose yasohowe.
5. urufunguzo rwa macOS n'umusuma wa macOS (AMOS / umusuma w'ibara):
6. Ku Apple macOS, abasuma b’amakuru biyoberanya nk’ .dmg downloads (kenshi bigusaba "Fyonda iburyo -> Gufungura" canke gukurura ikimenyetso ku Terminal kugira ngo unyure kuri Apple Gatekeeper) bigutera akazu k'ikiganiro k'ikinyoma ka macOS gasoma "Ivyo Ukunda muri Sisitemu bishaka gushika ku makuru yawe y'ibanga: Shiramwo ijambobanga ryawe ryo kwinjira muri Mac". Igihe wandika ijambobanga ryawe ryo kwinjira muri Mac muri iyo nzira, inyandiko irafungura -/Library/Keychains/login.keychain-db kandi akopa amakuru ya Safari/Chrome, Ivyanditswe vya Apple, n’ibimenyetso vya iCloud.
7. Google MultiLogin / OAuthLogin Igikoresho co gusubirana kw'ikimenyetso:
8. Abashakashatsi mu vy’umutekano bamenyesheje ko abasuma b’amakuru batiba gusa amakuru y’urubuga asanzwe, bakuramwo n’amakuru atagira ivyangombwa oauth_token Ibimenyetso vya serivisi bivuye kuri Chrome Web Data (token_service imeza) dosiye ya SQLite. Naho umuntu amaze guhindura ijambobanga ryiwe rya Google rimwe, abamutera boshobora gusubiramwo ijambobanga ryiwe ryibwe . token_service Ikimenyetso ca OAuth kirwanya imbere muri Google OAuthLogin iherezo ry'imint rishasha rikora SID amakuru y'umucukumbuzi kiretse iyo umukoresha yasohotse mu gihe c'igikoresho ca Chrome cahungabanijwe KANDI akuraho uburenganzira bwo gukoresha igikoresho c'uwundi muntu/OAuth.

Intambwe ya 1: Igihe c'Isi Yose, Kuki, OAuth, n'Ikigereranyo co Gukuraho Urufunguzo rw'Ibanga¶

Ukoresheje telefone ngendanwa isukuye canke mudasobwa ya kabiri isukuye, kora hasi kuri iyi meza nyayo kuva hejuru gushika hasi. Ibibazo vy'urutonde: wama ukora Intambwe A (Sohoka mu biganiro vyose bikora/ibikoresho) na Intambwe B (Guhindura ijambobanga) na Intambwe C (Igenzura 2FA/Passkeys/OAuth/Forwarding) hamwe, iyo uhinduye gusa ijambobanga ryawe ry'ibanga, tab iguma yinjiye kandi ishobora kukuraba canke yongerako uburyo bwo gusubizaho ubusuma.

Step 2: How to find out EVERY account that was exposed on your infected computer¶

After you have locked down your top 10 critical accounts on your clean phone, you face a daunting question: "I have used that computer for four years, how do I know which of my 250 websites had saved passwords or active cookies inside Chrome/Edge when the infostealer ran?"

While keeping the infected computer 100 percent offline (Wi-Fi OFF, Ethernet unplugged), turn it on and extract your exact exposure inventory before wiping the machine:

1. Export your Browser Saved Passwords List (CSV:
2. Open your browser offline (chrome://password-manager/settings in Chrome, edge://wallet/settings in Edge, or about:logins in Firefox) and click Export passwords to save Chrome Passwords.csv onto a clean USB flash drive.
3. Why this file is gold for your recovery: The infostealer stole this exact database. Having Chrome Passwords.csv in front of you gives you the exact checklist of every single website username and password the attacker now possesses, so you don't miss an old tax portal, airline miles account, or shopping site with a saved credit card.
4. Inspect which websites had active Session Cookies (chrome://settings/content/all:
5. Muri Chrome canke Edge (igihe utari kuri interineti), genda kuri chrome://settings/content/all (canke edge://settings/content/all) hanyuma ushiremwo Amakuru yabitswe canke Ayasuwe cane. Urubuga rwose aho wagumye winjiye utanditse ijambobanga ryari rishobora gushikirwa n’ubusuma bw’amakuru y’ikiganiro kandi ryari rikeneye ko ikiganiro caco gihagarara.
6. Suzuma nimba umucungerezi wawe w'ijambobanga (1Ijambobanga, Bitwarden, KeePassXC) yari yafunguwe igihe wanduzwa:
7. Nimba ububiko bwawe bwa 1Password, Bitwarden, canke KeePassXC bwari BUKINGIWE igihe umusuma w'amakuru yariko aragenda: Porogaramu mbi yashobora gufata gusa ububiko bw'ububiko bw'aho hantu (data.json canke .kdbx), irindwa na PBKDF2-SHA256 / Argon2id + Ijambobanga ryawe ry’Ibanze (n’Urufunguzo rw’Ibanga rw’inyuguti 34 muri 1Ijambobanga). Nimba Ijambobanga ryawe ry’Ishengero rikomeye, ibirimwo mu nzu yawe y’ububiko biraguma bitekanye, naho woba ukwiye guhindura Ijambobanga ryawe ry’Ishengero nk’ukwiyubara.
8. Nimba ijambobanga ryawe ry'umucukumbuzi ry'umucukumbuzi ryari RIKUNGURIWE mu bwenge igihe porogaramu mbi yariko irakora (canke nimba wabitse ijambobanga ryawe ry'umucungerezi w'ijambobanga ry'umucukumbuzi w'ijambobanga ry'umucukumbuzi wa Chrome.): Wiyumvire ko infostealer yajugunye ububiko bwawe canke yafashe ijambobanga ryawe ry'umucukumbuzi, hanyuma uhindure ijambobanga ryawe ry'ingenzi.

Intambwe ya 3: Guhigira no kurandura Infostealer gushikama imbere yo guhanagura OS¶

Imbere yo gukora backup y’inyandiko zawe bwite no gukora igikorwa co gusubira gushiramwo OS isukuye, urashobora gusuzuma ingene infostealer yinjiye muri sisitemu yawe be n’uko yoba yashizeho ikintu gikomeye co gushiramwo ibintu (nk’igikorwa gitegekanijwe, Registry . Run Urufunguzo, Gutangura .lnk inzira ngufi, canke Ukwagura kwa Chrome nabi):

1. Gukoresha iyi nkuru y'ubugenzuzi bw'ugushikama kwa PowerShell (Windows)¶

Gufungura PowerShell (Umuyobozi) kuri PC itari ku murongo maze ukoreshe ibi bipimo bine vy'ubuhinga bwo gusoma gusa:

# 1. Check the Windows Run/RunOnce Registry Keys for user-level malware loaders in AppData/Temp:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                       "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
                       "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue

# 2. Check the Startup Folder for suspicious .lnk, .vbs, .bat, or .exe files:
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
                    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force

# 3. List all Scheduled Tasks created or modified in the last 7 days calling PowerShell, cmd, mshta, or AppData:
Get-ScheduledTask | Where-Object { $_.State -ne "Disabled" } | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    foreach ($action in $_.Actions) {
        if ($action.Execute -match "powershell|cmd|mshta|wscript|cscript|rundll32|regsvr32|AppData|Temp|ProgramData") {
            [PSCustomObject]@{
                TaskName = $_.TaskName
                Execute  = $action.Execute
                Args     = $action.Arguments
                LastRun  = $info.LastRunTime
            }
        }
    }
} | Format-Table -AutoSize

# 4. Check Windows Defender Exclusions (Infostealers immediately add C:\ or AppData to Defender Exclusions.):
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath | ForEach-Object { Remove-MpPreference -ExclusionPath $_ }

2. Kubera iki gusubira gushiramwo OS isukuye (biciye kuri USB Media) ari vyiza Inyuma y’Ukwiba Amakuru¶

Mu gihe ukoresha Microsoft Defender Offline Scan na Malwarebytes inyuma yo gukuraho ibintu bitari muri Defender bikuraho ibikoresho bizwi vy’ugushikama, abasuma b’amakuru y’ibicuruzwa kenshi bafatanya Imbeba (Imbeba), **SystemBC SOCKS5 igitabo cawe ca Windows maze ugahindura aderesi iyo ari yo yose y’ipoke ya Bitcoin/Ethereum ikopiwe n’aderesi y’umunyaruyeri). - Umaze gukopa inyandiko zawe bwite, amafoto, n’ Chrome Passwords.csv PC itari ku murongo, kora igikorwa gisukuye Windows 11 USB Gusubiramwo (canke macOS Gukuraho Ibirimwo Vyose n'Imiterere) ukurikije ivyacu Porogaramu mbi, porogaramu y'incungu, n'uburongozi bw'imigera ya porogaramu y'ubutasi.

3. Gusuzuma ubuhinga bwa macOS na Linux ku bikoresho vy’ubuhinga bwa Infostealer (Atomic macOS Stealer / AMOS, Poseidon, n'Ivyagutse vy'Umucukumbuzi w'Ibibi)¶

Niba imashini yawe yanduye ari Apple MacBook/iMac canke ikibanza co gukoreramwo abahinguzi ba Linux aho kuba PC ya Windows, koresha ibi bipimo vy’inyuma kugira ngo umenye kandi ukureho ugushikama:

# On Apple macOS:
# 1. Check for unauthorized LaunchAgents and LaunchDaemons dropped by AMOS / Poseidon Stealer:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

# 2. Check for hidden staging folders in /tmp or /var/folders created by AppleScript / osascript stealers:
find /tmp /var/folders -iname "*out.zip*" -o -iname "*passwords.txt*" -o -iname "*cookies*" 2>/dev/null

# 3. Inspect installed Chrome / Brave / Edge Extensions for rogue manifest permissions ('cookies', 'webRequest', '<all_urls>'):
grep -rn '"permissions"' ~/Library/Application\ Support/Google/Chrome/Default/Extensions/ 2>/dev/null

4. Ishirahamwe n'Igicu c'Ubuyobozi (Indangamuntu ya Microsoft, Okta, Ahantu h'Akazi ka Google, na AWS IAM)¶

Nimba mudasobwa yandujwe n’umusuma w’amakuru yari iy’umuhinga mu vy’amaporogarama, umuyobozi wa DevOps, canke umukozi w’ishirahamwe yari afise ibiganiro bikora muri Microsoft Entra ID (Azure AD), Okta, Google Workspace, AWS, canke Cloudflare, gusukura ibikoresho vyo mu karere ni igice c’intambara gusa. Shira mu ngiro ibi bikuweho ububiko bw'igicu ubwo nyene:

• Indangamuntu y'injira ya Microsoft (Revoke-MgUserSignInSession): Gukanda "Sohoka" mu mucukumbuzi umwe ntivyama bikuraho ibimenyetso vy'intango vyo gusubiramwo (PRTs) canke Azure CLI (az login / .azure/msal_token_cache.bin) ibimenyetso vyakopiwe kuri disiki. Umuyobozi wa Entra ategerezwa gukora Revoke-MgUserSignInSession -UserId user@company.com mu gishushanyo ca Microsoft PowerShell kugira ngo usubiremwo ivy'ukoresha signInSessionsValidFromDateTime n'ugukuraho ibimenyetso vyose vy'ugusubiramwo ku mpera zose icarimwe.
• AWS CLI & Guhinduranya ikimenyetso c'umuhinguzi (-/.aws/credentials, -/.npmrc, -/.pypirc, -/.kube/config): Abasuma b'amakuru y'ibicuruzwa barasuzuma neza ububiko bw'inzu y'ukoresha wese .aws/credentials, .ssh/id_ed25519, .gitconfig, .env, n'amadosiye y'imiterere ya Docker/Kubernetes. Ubwo nyene uzimye kandi uhindure AWS IAM Access Imfunguruzo zose (AKIA...) muri AWS Console, gukuraho Ibimenyetso vy'Ukwinjira kwa GitHub (ghp_...), kandi usibe imfunguruzo za bose za SSH zivuye ku maserukira y'ibikorwa (-/.ssh/authorized_keys).
• Ubutumwa bwo ku biro n'ikimenyetso c'umukiriya wa VPN (Ibiro vya Telegram tdata, Ikimenyetso, Slack, OpenVPN, WireGuard): Inyuma y'ibikoresho vyo ku rubuga, ibice vy'ububisha vy'umwihariko bikopa %APPDATA%\Telegram Desktop\tdata ububiko (bushobora gutuma uwugutera ashobora gukora clone ya konti yawe yose ya Telegram kuri PC yiwe ata kode ya SMS), %APPDATA%\Slack\storage, kandi ubitse GufunguraVPN (.ovpn) / Umurinzi w'intsinga (.conf) corporate VPN profiles. Open Telegram on your phone (Settings > Devices -> Terminate All Other Sessions), sign out all Slack workspaces (slack.com/account/settings -> Sign out all other sessions), and ask your network administrator to revoke and reissue your corporate VPN client certificate.

Prevention: How to make your browser and accounts resistant to Infostealers¶

Once your system is clean and your accounts are recovered, implement these five defenses so an infostealer can never hijack your digital life again:

• NEVER store passwords inside your web browser's built-in password manager (Chrome / Edge / Brave / Firefox Autofill) without a Hardware/Master Key: Every commodity infostealer on Earth targets Chrome's Login Data SQLite table first. Turn OFF "Offer to save passwords" in chrome://password-manager/settings and store your passwords inside a dedicated, zero-knowledge password manager (1Password, Bitwarden, Proton Pass, or KeePassXC) configured to Auto-Lock immediately when the system locks or after 5 minutes of idle time.
• Enable "Device-Bound Session Credentials (DBSC)" & "App-Bound Encryption" in Chrome 127+: Make sure Google Chrome or Edge is updated to the latest version and installed in the default system directory (C:\Program Files\Google\Chrome\Application) so the GoogleChromeElevationService can bind cookie encryption to system privilege levels and TPM hardware keys via Device-Bound Session Credentials (DBSC).
• Disable the Windows Run Box (Win + R) or mshta.exe to block "ClickFix" Fake CAPTCHA Attacks: Never press Win + R -> Ctrl + V -> Enter when a website CAPTCHA, fake Cloudflare screen, or "Fix Microphone / Fix Font" pop-up asks you to paste a command into your Run dialog or Terminal, no legitimate website on Earth ever verifies humanity by asking you to paste code into Win + R or macOS Terminal.
• Use Hardware Security Keys (YubiKey) or Passkeys + Require Re-Authentication for Sensitive Actions: While stolen session cookies bypass initial login prompts, major platforms (Google, GitHub, Cloudflare, AWS, Coinbase) enforce Step-Up Authentication (Sudo Mode) requiring a physical FIDO2 YubiKey tap or Passkey biometric check before allowing anyone with a session cookie to change your password, export data, or add a withdrawal address.
• Check if your email or stealer log has appeared on Darknet Monitoring Databases: Visit haveibeenpwned.com (which now indexes millions of stealer log victim email addresses and compromised domains) and enable free darknet breach notifications for your email addresses.
• Isolate untrusted downloads, game mods, and third-party scripts inside a Virtual Machine or Windows Sandbox: Never run unverified .exe, .msi, .dmg, .bat, or Python pip / Node npm post-install scripts directly on the host operating system that holds your authenticated web browser sessions and financial logins. Enable Windows Sandbox (built into Windows 10/11 Pro and Enterprise via Turn Windows features on or off > Windows Sandbox) or use an isolated virtual machine with zero saved browser cookies when testing third-party utilities.

Ibibazo bikunda kubazwa¶

Inyobora zifitaniye isano¶

• Malware, ransomware, and spyware infection
• MFA ubuhendanyi n'umwansi-mu-hagati (AiTM) guca kure
• MFA lockout: how to recover locked accounts
• Email account hacked, forwarding rules, and recovery
• Cryptocurrency igikapu c'amazi n'imbuto y'amajambo yo gusenyera ku mugozi umwe
• Ijambobanga umucungerezi gufunga no gusubiza ububiko vyihutirwa
• Ububiko bw'inomero z'ivyihutirwa

Amasoko yasuzumwe¶

• Cybersecurity and Infrastructure Security Agency (CISA) & FBI (United States): Joint Cybersecurity Advisories on Infostealer Malware (LummaC2, RedLine, Rhadamanthys) and Mitigating Token/Session Theft (CSAE24 / MITRE ATT&CK T1539: Steal Web Session Cookie & T1550.004: Web Session Cookie).
• National Institute of Standards and Technology (NIST) (United States): NIST SP 800-63B: Digital Identity Guidelines: Session Management, Reauthentication, and Token Binding.
• World Wide Web Consortium (W3C) & Google Chromium Security Architecture: Device Bound Session Credentials (DBSC) Specification and Chrome App-Bound Encryption (v20 DPAPI Elevation) Technical Documentation.
• National Cyber Security Centre (NCSC) (United Kingdom): Mitigating Malware, Infostealers, and Session Hijacking in Enterprise and Consumer Environments.
• Open Worldwide Application Security Project (OWASP): Session Management Cheat Sheet & OAuth 2.0 Token Revocation (RFC 7009) Standards.