Session Token Hijacking, Infostealer Malware, and Global Session Revocation¶

Discovering that an attacker just posted cryptocurrency scams from your YouTube, Instagram, Discord, or X account, created forwarding rules in your Gmail or Microsoft 365 inbox, or accessed your corporate cloud console without ever triggering a 2FA code on your phone or a "New Login" email alert is the unmistakable signature of Session Cookie / Token Hijacking (Pass-the-Cookie) caused by Infostealer Malware. When you log into a website and check "Keep me signed in", the server issues an encrypted HTTP session cookie or OAuth bearer token (such as Google's SID / SAPISID, Microsoft's ESTSAUTHPERSISTENT, or Discord's Authorization token) stored inside your web browser's local SQLite database.

Commodity infostealer malware families, including Lumma Stealer, RedLine, Vidar, Raccoon, StealC, RisePro, Rhadamanthys, and Atomic macOS Stealer (AMOS), do not wait around on your computer like traditional viruses. Often disguised as a fake game mod, cracked software installer, fake "ClickFix" PowerShell CAPTCHA prompt, or sponsor collaboration PDF, an infostealer executes in under 4 seconds, decrypts your Chrome, Edge, Brave, or Firefox Cookies jeung Login Data databases in memory, zips them up with your desktop cryptocurrency wallet files, uploads the archive to a Telegram or C2 server, and deletes itself. When the attacker imports your stolen session cookies into an anti-detect browser (Multilogin, Dolphin{anty}, atawa Gologin), the web server thinks the attacker is your already-authenticated computer, completely bypassing both your password and your two-factor authentication.

Laksanakeun ieu ayeuna¶

1. STOP changing your passwords on the infected computer, immediately disconnect that PC or Mac from Wi-Fi and unplug its Ethernet cable. This is the #1 mistake victims make: they notice their Discord, Steam, or Gmail was hijacked, sit down at the exact same infected desktop PC, and type brand-new passwords into Chrome. If an infostealer persistence loader or scheduled task is still active on that machine, it will immediately capture your new passwords and fresh session cookies and send them right back to the attacker. Do 100 percent of your password changes and session revocations from a clean smartphone (on cellular data or clean Wi-Fi) or a separate, untouched laptop.
2. Understand that changing a password alone does NOT always invalidate stolen session cookies or OAuth refresh tokens, you MUST explicitly click "Sign Out of All Sessions" AND revoke third-party OAuth apps. On several platforms (and with Google's undocumented MultiLogin / issueToken OAuth endpoints or long-lived session tokens), simply changing your password or rotating 2FA can leave existing secondary session tokens or OAuth desktop tokens alive unless you execute the platform-specific Global Session & Token Revocation steps in the table below.
3. If you have a software cryptocurrency wallet extension (MetaMask, Phantom, Rabby, Trust Wallet, Coinbase Wallet, Exodus, Electrum) installed on the infected computer, use a clean phone right now to evacuate your funds to a brand-new hardware wallet seed phrase. Infostealer logs automatically harvest the encrypted vault files (Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn for MetaMask) alongside your browser saved passwords. Even if the attacker has not touched your crypto yet, your vault file is already sitting on a darknet market waiting for an offline GPU cracker. Execute our dompet cryptocurrency solokan jeung kompromi frase siki guide immediately.
4. Amankeun "Akun Idéntitas Apex" anjeun (Surélék Primer, Manajer Sandi, Akun Apple/Google, sareng SSO Perusahaan) dina 10 menit munggaran. Dina smartphone bersih anjeun, buka Google / Gmail primér anjeun (myaccount.google.com/device-activity) jeung Microsoft (mysignins.microsoft.com) rekening heula. Asup kaluar sadaya sesi desktop, puterkeun sandi master, pariksa ** Setélan > Neraskeun sarta POP / IMAP ** jeung ** Filter / Aturan ** pikeun mupus sagala aturan diteruskeun surelek disumputkeun ku panyerang dijieun pikeun nyumputkeun surelek reset sandi ti jasa lianna, sarta pariksa kadaptar Passkeys jeung alat Authenticator.
5. ** Audit pendaptaran Windows anjeun Run konci, Penjadwal Tugas, sareng sajarah PowerShell upami anjeun nembé ngajalankeun paréntah CAPTCHA palsu "ClickFix" (Win + R -> Ctrl + V).** Salah sahiji vektor infostealer anu panggancangna ngembang ayeuna nyaéta Cloudflare palsu atanapi Google CAPTCHA popup dina halaman wéb anu maréntahkeun anjeun pikeun "Pencét Win + R, pencét Ctrl + V, sarta pencét Enter pikeun mastikeun yén anjeun manusa" (anu cicingeun ngalaksanakeun disumputkeun mshta.exe atawa powershell -w hidden -enc ... paréntah disalin kana clipboard anjeun).
6. Ngajaga sudut pandang sareng ngajagi kasalametan fisik upami pelanggaranna kalebet infrastruktur perusahaan atanapi pemerasan. Log Infostealer sering memicu tebusan otomatis atanapi email sextortion anu ngutip kecap konci anjeun anu dipaling. Pernah mayar extortionists; tingali urang sextortion sarta meres online pituduh, sareng upami anjeun kantos nyanghareupan ancaman fisik, nelepon nomer darurat lokal anjeun (911 di Amérika Serikat sareng Kanada, 112 di Uni Éropa, 999 di Inggris, atanapi tingali kami nomer darurat diréktori).

Infostealer & sési cookie hijacking tangkal kaputusan respon kajadian¶

flowchart TD
    Root["Disangka Cookie Hijacking atanapi Inféksi Malware Infostealer"] --> IsolatePC["Léngkah 1: Langsung Pegatkeun Sambungan PC / Mac anu Katépa tina Wi-Fi & Ethernet (ULAH Robah Sandi dina PC Katépaan)"]

    IsolatePC --> CryptoCheck{"Naha Aya Ekstensi Dompét Crypto (MetaMask, Phantom, Exodus) dina PC Éta?"}
    CryptoCheck -->|"Sumuhun"| EvacCrypto["Anggo Dompét Telepon/Hardware anu Beresih Langsung pikeun Sapu Sadaya Aset Crypto kana Frasa Bibit Anyar"]
    CryptoCheck -->|"No"| ApexLock["Léngkah 2: Dina Smartphone Beresih, Konci Email Utama (Gmail, Outlook, Proton) Mimiti"]
    EvacCrypto --> ApexLock

    ApexLock --> GlobalRevoke["Léngkah 3: Laksanakeun Sidang Global + Token OAuth + Panyabutan Sandi Dina Sadaya Akun Kritis (Tingali Platform Matrix Di handap)"]

    GlobalRevoke --> ExportList["Léngkah 4: Dina PC Katépaan Offline, Daptar Ékspor Sadayana Kecap aksés Browser & Cookies anu Disimpen pikeun Nyaho Akun Mana Anu Dipaling"]

    ExportList --> CleanOS["Léngkah 5: Nyadangkeun Dokumén Pribadi Ngan -> Laksanakeun Bersih OS Ngusap / Pasang Ulang -> Ngadaptar Ulang Sandi & Aktipkeun Enkripsi Chrome App-Bound"]

Ngartos kumaha Infostealers ngalangkungan enkripsi 2FA sareng DPAPI / Keychain¶

Kumaha program 200 kilobyte tiasa maok kecap akses sareng cookies sési anu énkripsi Google Chrome, Microsoft Edge, sareng Brave dina hard drive anjeun?

1. Windows DPAPI (CryptUnprotectData) jeung Chrome App-Bound Encryption (v20):
2. Dina Windows, browser basis Chromium (Chrome, Edge, Brave, Opera, Vivaldi) nyimpen kecap akses anjeun nu disimpen di jero. %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data sareng cookies sési anjeun di jero \Network\Cookies.
3. Database SQLite ieu énkripsi sareng konci master AES-256-GCM anu disimpen di %LOCALAPPDATA%\Google\Chrome\User Data\Local State, nu ditangtayungan ku Windows Data Protection API (DPAPI) dihijikeun ka akun pamaké Windows Anjeun nu asup log.
4. Kusabab anjeun ngajalankeun infostealer sakumaha pangguna Windows anu anjeun log-in, prosés naon waé anu dijalankeun dina akun pangguna anjeun tiasa nelepon. CryptUnprotectData() pikeun ménta Windows pikeun ngadekrip konci. Sareng pikeun ngalangkungan Chrome 127+ App-Bound Énkripsi (v20 jasa lift), infostealer modern nyuntik langsung kana headless a chrome.exe prosés debugging (--remote-debugging-port) atanapi nganggo élévasi COM pikeun naroskeun Chrome nyalira pikeun ngaleungitkeun sadaya cookies anu didekripsi langsung.
5. MacOS Keychain & Atomic macOS Stealer (AMOS / PoseStealer):
6. Dina Apple macOS, infostealer nyamar salaku .dmg unduhan (sering naroskeun anjeun "Klik katuhu -> Buka" atanapi sered ikon ka Terminal pikeun ngaliwat Apple Gatekeeper) pop up kotak dialog macOS asli palsu maca "Préferénsi Sistem hoyong ngaksés inpormasi rahasia anjeun: Lebetkeun sandi login Mac anjeun". Sakali anjeun ngetik sandi login Mac anjeun kana ajakan éta, skrip muka konci -/Library/Keychains/login.keychain-db sareng nyalin cookies Safari/Chrome, Apple Notes, sareng token iCloud.
7. ** Google MultiLogin / OAuthLogin Eksploitasi Regenerasi Token**:
8. Panaliti kaamanan ngungkabkeun yén infostealer henteu ngan ukur maok cookies wéb standar, aranjeunna ogé ékstrak anu henteu didokumentasikeun oauth_token service tokens from Chrome's Web Data (token_service table) SQLite file. Even after a victim changes their Google password once, attackers could previously replay the stolen token_service OAuth token against Google's internal OAuthLogin endpoint to mint brand-new valid SID browser cookies unless the user explicitly signed out the compromised Chrome device session AND revoked third-party/OAuth device access.

Step 1: Global Session, Cookie, OAuth, and Passkey Revocation Matrix¶

Using a clean smartphone or clean secondary computer, work down this exact table from top to bottom. Order matters: always do Step A (Sign out all active sessions/devices) and Step B (Change password) and Step C (Audit 2FA/Passkeys/OAuth/Forwarding) together, if you only change your password without terminating active sessions, the attacker's live browser tab stays logged in and can watch you or add a rogue recovery method.

Léngkah 2: Kumaha cara mendakan unggal akun anu kakeunaan dina komputer anu katépaan anjeun¶

Saatos anjeun ngonci 10 akun kritis anu paling luhur dina telepon anjeun anu bersih, anjeun bakal nyanghareupan patarosan anu pikasieuneun: * "Kuring parantos nganggo komputer éta salami opat taun, kumaha kuring terang mana tina 250 situs web kuring anu nyimpen kecap akses atanapi cookies aktip dina Chrome/Edge nalika infostealer jalan?"*

Bari ngajaga komputer nu kainféksi ** 100 persen offline (Wi-Fi OFF, Ethernet unplugged)**, hurungkeun tur ékstrak inventaris paparan pasti anjeun saméméh ngusap mesin:

1. ** Ékspor Daptar Sandi anu Disimpen Browser anjeun (CSV)**:
2. Buka browser anjeun offline (chrome://password-manager/settings dina Chrome, edge://wallet/settings di Tepi, atawa about:logins dina Firefox) teras klik Ékspor kecap akses pikeun nyimpen Chrome Passwords.csv kana USB flash drive anu bersih.
3. ** Naha file ieu emas pikeun recovery Anjeun **: Infostealer maok database pasti ieu. Ngabogaan Chrome Passwords.csv di hareup anjeun masihan anjeun ** Daptar pariksa pasti tina unggal nami pangguna sareng kecap konci halaman wéb anu ayeuna dipiboga ku panyerang **, ku kituna anjeun henteu sono kana portal pajak kuno, akun mil maskapai, atanapi situs balanja kalayan kartu kiridit anu disimpen.
4. ** Pariksa situs wéb mana anu gaduh Cookies Sesi aktip (chrome://settings/content/all)**:
5. Dina Chrome atanapi Edge (bari offline), buka chrome://settings/content/all (atawa edge://settings/content/all) jeung diurutkeun dumasar Data disimpen atawa Paling dilongok. Sakur situs wéb dimana anjeun tetep asup tanpa ngetik kecap konci rentan ka maling cookie sési sareng peryogi sésina ditungtungan.
6. **Parios upami Manajer Sandi Mandiri anjeun (1Password, Bitwarden, KeePassXC) Henteu dikonci dina Momen Inféksi **:
7. Upami kolong 1Password, Bitwarden, atanapi KeePassXC anjeun dikonci nalika infostealer jalan: Malware ngan ukur tiasa nyandak cache kolong lokal anu énkripsi (data.json atawa .kdbx), anu ditangtayungan ku PBKDF2-SHA256 / Argon2id + Sandi Master anjeun (sareng 34-karakter Rahasia Key dina 1Password). Upami Sandi Master anjeun kuat, eusi kolong anjeun tetep aman, sanaos anjeun tetep kedah muterkeun Sandi Master anjeun salaku pancegahan.
8. **Upami ekstensi browser pangatur sandi anjeun teu dikonci dina mémori ** nalika malware ngajalankeun (atanapi upami anjeun nyimpen Sandi Master Pangatur Kecap aksés anjeun di jero eusian otomatis Chrome.): Anggap infostealer ngalungkeun kolong anjeun atanapi néwak Sandi Master anjeun, sareng puterkeun sadaya kredensial kritis di jero kolong anjeun.

Lengkah 3: Moro sareng ngabasmi kegigihan Infostealer sateuacan ngusap OS¶

Sateuacan nyadangkeun dokumén pribadi anjeun sareng ngalaksanakeun pamasangan ulang OS anu bersih, anjeun tiasa mariksa kumaha infostealer lebet kana sistem anjeun sareng naha éta ngarobih loader sekundér anu terus-terusan (sapertos Tugas Terjadwal, Pendaptaran. Run konci, ngamimitian .lnk potong kompas, atawa Extension Chrome jahat):

1. Jalankeun ieu Offline PowerShell Persistence Audit (Windows)¶

Buka PowerShell (Admin) dina PC offline sareng jalankeun opat pamariksaan forensik anu dibaca wungkul ieu:

# 1. Check the Windows Run/RunOnce Registry Keys for user-level malware loaders in AppData/Temp:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                       "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
                       "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue

# 2. Check the Startup Folder for suspicious .lnk, .vbs, .bat, or .exe files:
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
                    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force

# 3. List all Scheduled Tasks created or modified in the last 7 days calling PowerShell, cmd, mshta, or AppData:
Get-ScheduledTask | Where-Object { $_.State -ne "Disabled" } | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    foreach ($action in $_.Actions) {
        if ($action.Execute -match "powershell|cmd|mshta|wscript|cscript|rundll32|regsvr32|AppData|Temp|ProgramData") {
            [PSCustomObject]@{
                TaskName = $_.TaskName
                Execute  = $action.Execute
                Args     = $action.Arguments
                LastRun  = $info.LastRunTime
            }
        }
    }
} | Format-Table -AutoSize

# 4. Check Windows Defender Exclusions (Infostealers immediately add C:\ or AppData to Defender Exclusions.):
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath | ForEach-Object { Remove-MpPreference -ExclusionPath $_ }

2. Naha a Reinstall OS Bersih (via USB Media) Disarankeun sanggeus hiji Infostealer¶

Nalika ngajalankeun Microsoft Defender Offline Scan sareng Malwarebytes saatos ngabersihkeun pangecualian Defender ngaleungitkeun loaders kegigihan anu dipikanyaho, para infostealer komoditi sering ngabuntel ** RAT (Remote Access Trojan)** sekundér, SystemBC SOCKS5 proxy, atanapi clipper malware (anu cicingeun ngawas Bitcoin / E ngawaskeun alamat Windows copieum anjeun. alamat hacker). - Sakali anjeun nyalin dokumén pribadi anjeun, poto, sareng Chrome Passwords.csv off PC offline, laksanakeun bersih Windows 11 USB Reinstall (atanapi macOS Hapus Sadayana Eusi sareng Setélan) nuturkeun kami. malware, ransomware, sareng pituduh inféksi spyware.

3. Auditing macOS sareng Linux Systems pikeun Artefak Infostealer (Atomic macOS Stealer / AMOS, Poseidon, sareng Extension Browser jahat)¶

Upami mesin anjeun anu katépaan nyaéta Apple MacBook/iMac atanapi workstation pamekar Linux tinimbang PC Windows, jalankeun pamariksaan terminal offline ieu pikeun ngadeteksi sareng ngabasmi kegigihan:

# On Apple macOS:
# 1. Check for unauthorized LaunchAgents and LaunchDaemons dropped by AMOS / Poseidon Stealer:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

# 2. Check for hidden staging folders in /tmp or /var/folders created by AppleScript / osascript stealers:
find /tmp /var/folders -iname "*out.zip*" -o -iname "*passwords.txt*" -o -iname "*cookies*" 2>/dev/null

# 3. Inspect installed Chrome / Brave / Edge Extensions for rogue manifest permissions ('cookies', 'webRequest', '<all_urls>'):
grep -rn '"permissions"' ~/Library/Application\ Support/Google/Chrome/Default/Extensions/ 2>/dev/null

4. Enterprise & Cloud Admin Containment (Microsoft Entra ID, Okta, Google Workspace, sareng AWS IAM)¶

Upami komputer anu kainféksi ku infostealer milik insinyur software, administrator DevOps, atanapi karyawan perusahaan anu ngagaduhan sesi aktif dina Microsoft Entra ID (Azure AD), Okta, Google Workspace, AWS, atanapi Cloudflare, ngabersihan alat lokal ngan ukur satengah perang. Laksanakeun panyabutan diréktori awan ieu langsung:

• Microsoft Entra ID (Revoke-MgUserSignInSession): Ngaklik "Kaluar" dina hiji browser teu salawasna nyabut Primary Refresh Tokens (PRTs) atanapi Azure CLI (az login / .azure/msal_token_cache.bin) tokens disalin ti disk. Administrator Entra kedah ngajalankeun Revoke-MgUserSignInSession -UserId user@company.com dina Microsoft Graph PowerShell pikeun ngareset pamaké signInSessionsValidFromDateTime atribut sareng ngabatalkeun sadaya Token Refresh dina sadaya titik tungtung sakaligus.
• AWS CLI & Rotasi Token Pangembang (-/.aws/credentials, -/.npmrc, -/.pypirc, -/.kube/config): Infostealer komoditi sacara eksplisit nyeken diréktori imah unggal pamaké pikeun .aws/credentials, .ssh/id_ed25519, .gitconfig, .env, sareng file config Docker/Kubernetes. Langsung nonaktipkeun sareng puterkeun sadaya AWS IAM Access Keys (AKIA...) dina AWS Console, cabut GitHub Personal Access Tokens (ghp_...), sareng pupus konci umum SSH anu kakeunaan tina server produksi (-/.ssh/authorized_keys).
• ** Olahtalatah Desktop & Pembersihan Token Klién VPN (Telegram Desktop tdata, Signal, Slack, OpenVPN, WireGuard)**: Saluareun panyungsi wéb, modul infostealer husus nyalin %APPDATA%\Telegram Desktop\tdata diréktori (anu ngamungkinkeun panyerang pikeun clone sadayana akun Telegram anjeun kana PC na tanpa kode SMS), %APPDATA%\Slack\storage, tur disimpen OpenVPN (.ovpn) / WireGuard (.conf) propil VPN perusahaan. Buka Telegram dina telepon anjeun (Setélan> Alat -> Nutup Sadaya Sesi Séjén), kaluar sadaya ruang kerja Slack (slack.com/account/settings -> Kaluar sadaya sesi anu sanés), teras naroskeun ka administrator jaringan anjeun pikeun nyabut sareng ngaluarkeun deui sertipikat klien VPN perusahaan anjeun.

Pencegahan: Kumaha carana ngadamel browser sareng akun anjeun tahan ka Infostealer¶

Sakali sistem anjeun beresih sareng akun anjeun pulih, laksanakeun lima pertahanan ieu supados hiji infostealer moal tiasa ngabajak kahirupan digital anjeun deui:

• JANGAN PERNAH nyimpen kecap akses di jero pangatur kecap akses browser wéb anjeun (Chrome / Edge / Brave / Firefox Autofill) tanpa Hardware/Master Key: Unggal infostealer komoditi di Bumi nargétkeun Chrome Login Data tabél SQLite munggaran. Pareuman OFF "Tawarkeun pikeun nyimpen kecap akses" dina chrome://password-manager/settings sareng simpen kecap akses anjeun dina manajer sandi anu khusus, nol-pangaweruh (1Password, Bitwarden, Proton Pass, atanapi KeePassXC) dikonpigurasi ka Otomatis-Konci langsung nalika sistem ngonci atanapi saatos 5 menit waktos dianggurkeun.
• ** Aktipkeun "Device-Bound Session Credentials (DBSC)" & "App-Bound Encryption" dina Chrome 127+**: Pastikeun Google Chrome atanapi Edge diropéa kana versi panganyarna sareng dipasang dina diréktori sistem standar (C:\Program Files\Google\Chrome\Application) janten GoogleChromeElevationService tiasa meungkeut enkripsi cookie ka tingkat hak husus sistem jeung kenop hardware TPM via Device-Bound Sidang Kapercayaan (DBSC).
• ** Nonaktipkeun Windows Run Box (Win + R) atawa mshta.exe pikeun meungpeuk "ClickFix" Serangan CAPTCHA Palsu**: Ulah pencét Win + R -> Ctrl + V -> Enter nalika halaman wéb CAPTCHA, layar Cloudflare palsu, atanapi pop-up "Fix Microphone / Fix Font" naroskeun anjeun nempelkeun paréntah kana dialog Run atanapi Terminal anjeun, teu aya halaman wéb anu sah di Bumi anu kantos pariksa umat manusa ku naroskeun anjeun nempelkeun kode kana. Win + R atanapi macOS Terminal.
• ** Anggo Konci Kaamanan Hardware (YubiKey) atanapi Passkeys + Merlukeun Oténtikasi Ulang pikeun Aksi Sénsitip : Nalika cookies sési dipaling ngalangkungan paréntah login awal, platform utama (Google, GitHub, Cloudflare, AWS, Coinbase) ngalaksanakeun ** Auténtikasi Lengkah-Up (Mode Sudo) meryogikeun hiji FIDO2 fisik atanapi Yubi ngetok. ngarobah sandi anjeun, data ékspor, atawa tambahkeun alamat ditarikna.
• Parios upami email atanapi log maling anjeun parantos muncul dina Darknet Monitoring Databases: Visit haveibeenpwned.com (anu ayeuna ngindeks jutaan alamat email korban log maling sareng domain anu dikompromi) sareng ngaktifkeun béwara pelanggaran darknet gratis pikeun alamat email anjeun.
• Ngasingkeun unduhan anu teu dipercaya, mods kaulinan, sareng skrip pihak katilu dina Mesin Virtual atanapi Kotak Sandi Windows: Henteu pernah ngajalankeun anu henteu diverifikasi .exe, .msi, .dmg, .bat, atawa Python pip / Node npm pasang skrip langsung dina sistem operasi host anu nahan sesi browser wéb anu dioténtikasi sareng login kauangan. Aktipkeun Windows Sandbox (diwangun kana Windows 10/11 Pro and Enterprise via Hidupkeun atanapi mareuman fitur Windows > Windows Sandbox) atanapi nganggo mesin virtual terasing sareng nol cookies browser anu disimpen nalika nguji utilitas pihak katilu.

Patarosan anu sering ditaroskeun¶

Panungtun patali¶

• Malware, ransomware, sareng inféksi spyware
• MFA phishing jeung Adversary-in-the-Middle (AiTM) bypass
• MFA lockout: kumaha cageur akun dikonci
• Akun email diretas, aturan diteruskeun, sareng pamulihan
• Dompét Cryptocurrency solokan sareng kompromi frasa siki
• Pangatur kecap konci konci sareng pamulihan kolong darurat
• Diréktori nomer darurat

Sumber dipariksa¶

• Cybersecurity and Infrastructure Security Agency (CISA) & FBI (Amérika Serikat): Joint Cybersecurity Advisories on Infostealer Malware (LummaC2, RedLine, Rhadamanthys) jeung Mitigating Token/Session Theft (CSAE24 / MITER ATT&CK T1539: Maok & Web Session T1539: Maok & Web Session T1539: Maok & Web Session. Kuki).
• National Institute of Standards and Technology (NIST) (Amérika Serikat): NIST SP 800-63B: Pedoman Idéntitas Digital: Manajemén Sidang, Reauthentication, sareng Token Binding.
• World Wide Web Consortium (W3C) & Arsitéktur Kaamanan Google Chromium: Device Bound Session Credentials (DBSC) Spésifikasi sareng Chrome App-Bound Encryption (v20 DPAPI Elevation) Dokuméntasi Téknis.
• Pusat Kaamanan Siber Nasional (NCSC) (Inggris): Mitigating Malware, Infostealers, sareng Session Hijacking in Enterprise and Consumer Environments.
• Buka Proyék Kaamanan Aplikasi Di sakuliah dunya (OWASP): Lambaran Curang Manajemén Sesi & Standar Panyabutan Token OAuth 2.0 (RFC 7009).