Xañ token sesioŋ, Infostealer Malware, ak dindi sesioŋ globaal¶

Soo gisee ni ab songekat dugal na ay naxasaale ci sa kontu YouTube, Instagram, Discord, wala X, sos ay sàrti yebal ci sa boyet Gmail wala Microsoft 365, wala dugg ci sa konsol cloud liggéeyukaay ** te doo musa def benn kodu 2FA ci sa telefon wala ab "Dugg bu bees" buy àrtu ci imeel ** (Jëfandikoo-kukiis bi)** Losisielu sàcc xibaar moo ko waral. Soo duggee ci benn sitweb ba noppi nga xool "Bayyi ma dugg", serwër bi dafay joxe kuki sesioŋ HTTP buñ enkripte wala token porte OAuth (lu melni Google SID / SAPISID, ESTSAUTHPERSISTENT, wala Discord Authorization token) denc ci biir base de done SQLite bi ci sa nawigatër web.

Famiy xeetu loraange yiy sàcc xibaar, lu ci melni Sàcc Lumma, RedLine, Vidar, Raccoon, SàccC, RisePro, Rhadamanthys, ak Sàcc Atomik macOS (AMOS), duñu xaar ci sa ordinatër ni virus yiñ gëna xam. Dañu koy faral di degisewu ni mod jeu bu baaxul, instalatëru losisel buñ tass, "ClickFix" PowerShell CAPTCHA bu baaxul, wala PDF buy liggéeyandoo, ab sàcckat xibaar dafay def ci ** ci diir bu néew 4 simili **, di dekode sa Chrome, Edge, Brave, wala Firefox Cookies ak Login Data base de done yi ci mémoire bi, nga zip leen ci sa fichier portefeuille cryptocurrency, nga yebbi archive bi ci serwëru Telegram wala C2, ba noppi ** efaase boppam **. Su songekat bi dugalee say kuki sesioŋ yuñ sàcc ci benn nawigatër buy tere gis (Multilogin, Dolphin{anty}, wala Gologin), serwëru web bi dafa yaakaar ni ki la song mooy sa ordinatër buñ jota xam, te dafay romb sa baatu-jàll ak sa xam-xam bu am ñaari mbir yépp.

Defal lii leegi¶

1. ** STOP soppi sa baatu-jàll ci ordinatër bi feebar bi laal, ci saasi nga dindi PC wala Mac bi ci Wi-Fi bi te nga dindi fiil Ethernet bi.** Lii mooy #1 njuumte bi victim yi di def: ñu seetlu ni dañu jàpp seen Discord, Steam, wala Gmail, ñu toog ci benn baatu-jàll bu am feebar bi- Chro. Sudee ab infostealer persistence loader wala ab liggéey buñ jagleel mingi wéy di dox ci masin boobu, ci saasi dina jàpp sa baatu-jàll bu bees ak say kukiis sesioŋ yu bees ba noppi yónnee leen ci saasi ki lay song. Defal 100 pursaa ci sa coppite baatu-jàll ak dindi sesioŋ ci telefoon bu xarañ bu sell (ci done selulaar wala Wi-Fi bu sell) wala ordinatër portable bu wuute, buñu laalul.
2. Xamleen ni soppi baatu-jàll kese du saa yu nekk di dindi kuki sesioŋ yiñ sàcc wala token yiy yeesal OAuth, danga wara bës ci "Dellu ci Sesioŋ yépp" AK dindi aplikaasioŋu OAuth yu ñeneen ñi. Ci platform yu bari (ak Google's undocued MultiLogin / issueToken OAuth endpoints wala jetons session yu yàgg), soppi sa baatu-jàll wala wëlbati 2FA mën na bàyyi jetons session yu ñaareel yi fi nekk wala jetons biro OAuth ñuy dundu fileek defoo jéego yi jëm ci platform bi ** Sesioŋ Global & Token Revocation ** ci tablo bi ci suuf.
3. **Sudee am nga losisel buy yokk portefeuille cryptocurrency (MetaMask, Phantom, Rabby, Portefeuille Trust, Portefeuille Coinbase, Exodus, Electrum) buñ samp ci ordinatër bi feebar bi jàpp, jëfandikoo telefon bu sell leegi ngir dindi sa xaalis ci portefeylu hardware bu bees. fichiers (Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn ngir MetaMask) ci wetu baatu-jàll yi nga denc ci sa nawigatër. Doonte songekat bi laalagul sa crypto, sa fichier vault mingi toog ci marse darknet di xaar cracker GPU bu nekk ci net bi. Defal sunu portefeuille cryptocurrency drein ak jiwwu frase kompromis guide ci saasi.
4. Kaaraangeel sa "Kontu dàntite Apex" (Imeel bu njëkk, Responsab baatu-jàll, Kontu Apple/Google, ak SSO liggéeyukaay) ci 10 simili yu njëkk yi. Ci sa telefon bu sell, ubbil sa Google/Gmail bu njëkk (myaccount.google.com/device-activity) ak Mikrosoft (mysignins.microsoft.com) kontu yi njëkk. Dellu ci bépp sesioŋ desktop, wëlbati baatu-jàll bi gëna mag, xool ** Jekkal> Yebal ak POP / IMAP ** ak ** Seggal / Regle ** ngir efaase bépp sàrt bu nëbbu buy yebal imeel bi songekat bi defar ngir nëbb baatu-jàll reset imeel ci yeneen sarwis, ak xool Passkeys ak Authenticator yuñ bind.
5. Xool sa Bindu Windows Run caabi yi, oraaru liggéey yi, ak jaar-jaaru PowerShell sudee def nga "ClickFix" komand CAPTCHA bu baaxul (Win + R -> Ctrl + V). Benn ci vecteur yi gëna gaaw ci màgg tay mooy Cloudflare bu baaxul wala Google CAPTCHA buy jameet ci benn xët web bu lay digal nga "Bësal Win + R, bësal Ctrl + V, nga bës Enter ngir firndeel ni nit nga" (muy def ci ab tekkaaral lu nëbbu mshta.exe wala powershell -w hidden -enc ... komand bi nga kopie ci sa clipboard).
6. Topp perspective ak kaaraange physique sudee njuumte bi dafa laal infrastructure korporatif wala extortion. Infostealer logs yi dañuy faral di génne ransom otomatik wala sextortion imeel yuy joxe sa baatu-jàll buñ sàcc. Bul musa fay ñiy nangu xaalis; xoolal sunu sextortion ak chantage ci net bi guide, te soo musa jànkoonte ak jafe-jafe yaram, woo sa nimero urgence bi la gëna jege (911 ci Etats Unis ak Canada, 112 ci biir Union Européenne, 999 ci Royaume-Uni, wala nga xool sunu nimero paj mu jamp répertoire).

Infostealer & garabu dogal buy tontu jafe-jafey jàpp kukiis sesioŋ¶

flowchart TD
    Root["Dañu yaakaar ni dafay jàpp kuki sesioŋ bi wala infeksioŋu Infostealer"] --> IsolatePC["JËF 1: Ci saasi dindi PC/Mac bi feebar bi jàpp ci Wi-Fi & Ethernet (BUL soppi baatu-jàll ci PC bi feebar bi jàpp)"]

    IsolatePC --> CryptoCheck{"Ndax amoon na ay yokk ci portefeylu kripto (metamask, fantom, exodus) ci PC boobu?"}
    CryptoCheck -->|"Waaw"| EvacCrypto["Jëfandikool ab portefeylu telefon/hardware bu sell ci saasi ngir dindi bépp mbiri kripto ci benn mbindu jiwwu bu bees"]
    CryptoCheck -->|"Déedet"| ApexLock["Ci telefon bu sell, njëkkal tëj imeel bi njëkk (Gmail, Outlook, Proton)"]
    EvacCrypto --> ApexLock

    ApexLock --> GlobalRevoke["JËF 3: Def sesioŋ global + OAuth Token + Passkey Revocation ci bépp kontu bu am solo (xoolal matrix platform bi ci suuf)"]

    GlobalRevoke --> ExportList["STEP 4: Ci PC bu nekk ci net bi, génne limu baatu-jàll yi ak kukiis yi nga denc ngir xam bu baax ban kontu lañu sàcc"]

    ExportList --> CleanOS["JËF 5: Sauvegarde këyitu bopp kese -> Def OS bu sell fomp/sampaat -> Bindaat butoŋu jàll & may encryption Chrome App-Bound"]

Xam naka Infostealers di jaar ci 2FA ak DPAPI / encryption porte-clés¶

Nan la prograamu 200 kilobyte mëna sàccee baatu-jàll yi ak kuki sesioŋ yi Google Chrome, Microsoft Edge ak Brave enkripte ci sa disk dur?

1. Palanteer DPAPI (CryptUnprotectData) ak enkripsioŋ buñ tënk ci aplikaasioŋu Chrome (v20):
2. Ci biir Windows, navigateur yi lalu ci Chromium (Chrome, Edge, Brave, Opera, Vivaldi) dañuy denc say baatu-jàll yi nga denc ci biir %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data ak say kuki sesioŋ ci biir \Network\Cookies.
3. Yii base de done SQLite dañu leen enkripte ak caabi AES-256-GCM buñ denc ci %LOCALAPPDATA%\Google\Chrome\User Data\Local State, bi API Aar Done yu Windows (DPAPI) aare, boole ci sa kontu jëfandikukat Windows bi nga dugg.
4. Ndax danga doxal infostealer ni sa bopp jëfandikukat Windows, bépp liggéey bu dox ci sa kontu jëfandikukat mën na woo ci taarix CryptUnprotectData() ngir wax Windows mu dekode caabi gi. Ak ngir teggi Chrome 127+ enkripsioŋ buñ tënk ci aplikaasioŋ (v20 ascenseur), infostealers yu bees yi dañuy dugal ci benn bopp bu amul bopp chrome.exe debugging (--remote-debugging-port) wala jëfandikoo COM elevation ngir laaj Chrome ci boppam mu sànni bépp kukiis buñ dekode ci saasi.
5. ** porte-clés macOS & sàcc macOS atomik (AMOS / sàcc pose) **:
6. Ci macOS Apple, sàcckat yi dañu degisewu ni .dmg yebbi (dañu lay laaj nga "Bësal ci ndeyjoor -> Ubbi" wala nga diri ikon bi ci Terminal ngir moytu Apple Gatekeeper) dafay jameet benn boîte de dialogue macOS bu baaxul bumu bind "Tànneefi sistem bi dafa bëgga jëfandikoo sa leerali kumpa: Bindal sa baatu-jàll dugg Mac". Soo bindee sa baatu-jàll ngir dugg ci Mac ci laaj bi, script bi dafay ubbi -/Library/Keychains/login.keychain-db ak kopie kuki Safari/Chrome, Notu Apple, ak jeton iCloud.
7. Google MultiLogin / OAuthLogin Jëfandikoo defaraat token:
8. Gëstukat yi ci wàllu kaaraange dañu wane ni infostealers duñu sàcc kukiis web yiñ miin, dañuy génne itam lu amul këyit oauth_token jeton serwiis yu bawoo ci Chrome Web Data (token_service tablo) Fichier SQLite. Doonte kiñ ci lor soppi na baatu-jàll Google benn yoon, ñi koy song mën nañu ko njëkka jotaat baatu-jàll biñ sàcc token_service Jeton OAuth ci biir Google OAuthLogin endpoint ngir mint bu bees SID kukiis nawigatër bi fileek jëfandikukat bi ** génnewul sesioŋ jumtukaayu Chrome biñ laal AK baña jëfandikoo jumtukaayu ñeneen/OAuth**.

Jéego 1: Sesioŋ globaal, kukiis, OAuth, ak Matriks buy dindi butoŋu jàll¶

Jëfandikool telefoon bu xarañ bu sell wala ñaareelu ordinatër bu sell, nga wàcci tablo bi gëna jubal ci kaw ba ci suuf. Komànd dafa am solo: saa yu nekk defal Jéego A (Génn bépp sesioŋ/aparey buy dox) ak Jéego B (Soppi baatu-jàll) ak Jéego C (Xool 2FA/Passkeys/OAuth/Forwarding) ñoom ñaar, sudee dangay soppi sa baatu-jàll bu ànd ak baatu-jàll tab des dugg ci te mën nala seetaan wala yokk benn xeetu recuperation rogue.

2ème étape: Ni ngay xamee BÉPP kontu buñu wane ci sa ordinatër bu am feebar bi¶

Ginaaw boo tëjee sa 10 kontu yu gëna am solo ci sa telefon bu sell, danga jànkoonte ak laaj bu raglu: "Jëfandikoo naa ordinatër boobu ñeenti at, naka laa mëna xamee ban ci sama 250 sitweb moo denc baatu-jàll wala kukiis yuy dox ci biir Chrome / Edge bi infostealer bi di daw?"

Sooy tëye ordinatër bi feebar bi 100 pursaa ci net bi (Wi-Fi OFF, Ethernet debrancher), taalal ko nga génne sa inventaire exposition bu dëggu balaa ngay fomp masin bi:

1. Jëlal sa limu baatu-jàll yi nga denc ci sa nawigatër (CSV):
2. Ubbi sa nawigatër ci net bi (chrome://password-manager/settings ci krom, edge://wallet/settings ci Edge, wala about:logins ci Firefox) nga bës Jëmm baatu-jàll ngir denc Chrome Passwords.csv ci benn USB bu sell.
3. Li tax fichier bii nekk wurus ngir sa recuperation: Infostealer sàcc na base de done bii. Am Chrome Passwords.csv ci sa kanam daf lay jox limu xool bu dëggu bu bépp tur jëfandikukat ak baatu-jàll bi songekat bi am leegi, suko defee doo ñàkka am portaalu juuti bu yàgg, kontu kilometre aérien, wala sit jënd ak kàrtu kredi buñ denc.
4. Xool ban sitweb moo am kuki sesioŋ (chrome://settings/content/all):
5. Ci Chrome wala Edge (soo nekkee ci net bi), demal ci chrome://settings/content/all (wala edge://settings/content/all) nga tànnal ko ci Done yiñ denc wala Li gëna dem. Bépp sitweb boo duggee te bindul baatu-jàll mën nañu ko sàcc kukiis sesioŋ bi, te dafa wara jeexal sesioŋ bi.
6. Xool ndax sa njiitu baatu-jàll (1Baatu-jàll, Bitwarden, KeePassXC) tëjuwoon na ci waxtu infeksioŋ bi:
7. Sudee sa 1Baatu-jàll, Bitwarden, wala KeePassXC tëjuwoon nañu bi sàcckat bi di daw: loraange bi mënul jël ludul cache kofre biñ enkripte (data.json wala .kdbx), bi PBKDF2-SHA256 / Argon2id + sa Baatu-jàll bu mag (ak Caabi Sekkere bu am 34 araf ci 1Baatu-jàll) aaree. Sudee sa Baatu-jàll Master dëgër na, ëmbiitu sa coffre dafay des ci jàmm, waaye danga wara soppi sa Baatu-jàll Master ngir moytu.
8. Sudee sa extension navigateur manager baatu-jàll UNLOCKED ci memory bi malware bi di doxee (wala sudee danga denc sa baatu-jàll manager Master ci biir Chrome's autofill.): Xaarandil ni infostealer bi dafa sànni sa coffre wala jàpp sa baatu-jàll Master ci sa vault, nga wëlbati lépp lu am solo

Jéego 3: Rab ak dindi Infostealer baña bàyyi laata ngay fomp OS¶

Laata ngay sauvegarde say këyitu bopp ak def ab instalaasioŋ OS bu sell, mën nga xool ni infostealer bi duggee ci sa sistem ak ndax dafa daaneel ab loader budul jeex (lu melni ab Liggéey buñ jagleel, Registry Run caabi, tàmbali .lnk gaawaay, wala Extension Chrome bu bonn):

1. Doxal bii PowerShell bu amul lëkkaloo (Windows)¶

Ubbi PowerShell (Admin) ci PC bi nekkul ci net bi nga def ñeenti saytu forensiik yii ñuy jàng rek:

# 1. Check the Windows Run/RunOnce Registry Keys for user-level malware loaders in AppData/Temp:
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                       "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
                       "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue

# 2. Check the Startup Folder for suspicious .lnk, .vbs, .bat, or .exe files:
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
                    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" -Force

# 3. List all Scheduled Tasks created or modified in the last 7 days calling PowerShell, cmd, mshta, or AppData:
Get-ScheduledTask | Where-Object { $_.State -ne "Disabled" } | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    foreach ($action in $_.Actions) {
        if ($action.Execute -match "powershell|cmd|mshta|wscript|cscript|rundll32|regsvr32|AppData|Temp|ProgramData") {
            [PSCustomObject]@{
                TaskName = $_.TaskName
                Execute  = $action.Execute
                Args     = $action.Arguments
                LastRun  = $info.LastRunTime
            }
        }
    }
} | Format-Table -AutoSize

# 4. Check Windows Defender Exclusions (Infostealers immediately add C:\ or AppData to Defender Exclusions.):
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

Get-MpPreference | Select-Object -ExpandProperty ExclusionPath | ForEach-Object { Remove-MpPreference -ExclusionPath $_ }

2. Lu tax ñu digal ñu defaraat OS bu sell (jaaraleko ci media USB) ginaaw Infostealer¶

Bi ngay doxal Microsoft Defender Offline Scan ak Malwarebytes ginaaw boo dindi Defender exclusions yi dindi nañu sargalkat yu xam, sàcckat yi dañuy faral di boole ñaareelu RAT (Trojan Access Remote), **SystemBC SOCKS5 sa clipboard Windows ak weccoo bépp adres portefeylu Bitcoin / Ethereum buñ kopie ak adres pirat bi). - Gunaaw boo kopie say këyitu bopp, say nataal ak Chrome Passwords.csv ci PC bi nekk ci net bi, defal Windows 11 USB Sampaat (wala macOS efaase lépp lu ëmbiit li ak jekkal yi) topp sunu losisel buy yàq, losisel ransom, ak losisel espion.

3. Xool sistem macOS ak Linux ngir xam mbiri sàcc yi (Atomic macOS Stealer / AMOS, Poseidon, ak Extension Navigateur yu bon)¶

Sudee sa masin bi feebar bi jàpp Apple MacBook/iMac la wala station liggéeyukaay Linux moo gën PC Windows, defal saytu terminal yii ngir gis ak dindi persistance:

# On Apple macOS:
# 1. Check for unauthorized LaunchAgents and LaunchDaemons dropped by AMOS / Poseidon Stealer:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

# 2. Check for hidden staging folders in /tmp or /var/folders created by AppleScript / osascript stealers:
find /tmp /var/folders -iname "*out.zip*" -o -iname "*passwords.txt*" -o -iname "*cookies*" 2>/dev/null

# 3. Inspect installed Chrome / Brave / Edge Extensions for rogue manifest permissions ('cookies', 'webRequest', '<all_urls>'):
grep -rn '"permissions"' ~/Library/Application\ Support/Google/Chrome/Default/Extensions/ 2>/dev/null

4. Liggéeyukaay ak Admin Cloud (ID Entra Microsoft, Okta, Barabu Liggéey bu Google, ak AWS IAM)¶

Sudee ordinatër bi infostealer laal bokk na ci ingenieur u losisiel, administratër DevOps, wala liggéeykat liggéeyukaay bu amoon sesioŋ yu am solo ci ** Microsoft Entra ID (Azure AD), Okta, Google Workspace, AWS, wala Cloudflare **, setal aparey bi ci dëkk bi genn-wàll xeex la. Defal yii répertoire cloud ci saasi:

• ** ID duggu Microsoft (Revoke-MgUserSignInSession)**: Bësal "Génn" ci benn nawigatër du saa yu nekk di dindi Token yu njëkk yi (PRTs) wala Azure CLI (az login / .azure/msal_token_cache.bin) token yuñ kopie ci disk bi. Administratëru Entra dafa wara daw Revoke-MgUserSignInSession -UserId user@company.com ci Microsoft Graaf PowerShell ngir defaraat jëfandikukat bi signInSessionsValidFromDateTime attribute ak dindi bépp Refresh Token ci bépp endpoint ci benn yoon.
• AWS CLI & wëlbatiku token defarkat (-/.aws/credentials, -/.npmrc, -/.pypirc, -/.kube/config): Infostealers yi dañuy xool bépp répertoire bu jëfandikukat bi .aws/credentials, .ssh/id_ed25519, .gitconfig, .env, ak fichier configuration Docker/Kubernetes. Deaktiweel ci saasi te nga wëlbati bépp AWS IAM Access Caabi (AKIA...) ci biir AWS Console, dindi Token yiy dugg ci GitHub (ghp_...), ak efaase caabi SSH yiñ wane ci serwëru liggéey yi (-/.ssh/authorized_keys).
• Mesaas Biro & VPN Kiliyaan Token Purge (Biro Telegram tdata: Ginaaw nawigatëri web yi, modulu infostealer yi dañuy kopie %APPDATA%\Telegram Desktop\tdata répertoire (muy may ki lay song mu klone sa kontu Telegram yépp ci seen PC te du am kodu SMS), %APPDATA%\Slack\storage, nga denc OpenVPN (.ovpn) / Gardefil (.conf) profil VPN liggéeyukaay. Ubbi Telegram ci sa telefon (Jekkal > Jumtukaay -> Dakkal yeneen sesioŋ yépp), genn ci bépp barabu liggéey bu Slack (slack.com/account/settings -> Dellu ci yeneen sesioŋ yépp), nga wax sa administratëru reso bi mu dindi ba noppi joxewaat sa sertifikaa kiliyaan VPN liggéeyukaay.

Faggu: Ni ngay def ba sa nawigatër ak sa kontu baña nangu Infostealers¶

Gunaaw boo sa sistem set ba noppi sa kontu yi dellu, defal juróomi kaaraange yii suko defee infostealer baña mëna xajamal sa dundu digital:

• BUL MUSAA denc baatu-jàll ci biir njiitu baatu-jàll bi sa nawigatër web (Chrome / Edge / Brave / Firefox Autofill) te amoo Caabi Master / Master Key: Bépp jaaykatu xibaar ci àdduna bi dafay xool ci Chrome Login Data Tablo SQLite bi njëkk. Def OFF "Maa ngi denc baatu-jàll" ci chrome://password-manager/settings ak denc say baatu-jàll ci biir benn njiitu baatu-jàll bu amul benn xam-xam (1Baatu-jàll, Bitwarden, Proton Pass, wala KeePassXC) buñ defar ngir Tëju boppam ci saasi su sistem bi tëjoo wala ginaaw 5 simili yu amul benn liggéey.
• Aktiwiseel "Njàngalem sesioŋ buñ lëkkale ak aparey (DBSC)" & "Kifage buñ lëkkale ak aplikaasioŋ" ci Chrome 127+: Fexeel Google Chrome wala Edge yeesal ko ci bi mujjee am ba noppi samp ko ci répertoire sistem biñ jagleel (C:\Program Files\Google\Chrome\Application) kon GoogleChromeElevationService mën lëkkale encryption kukiis ak niveau privilège sistem ak caabi hardware TPM jaaraleko ci Krédential Session buñ lëkkale ci aparey (DBSC).
• Desactivé boîte de données Windows (Win + R) wala mshta.exe ngir tere "ClickFix" Cong CAPTCHA yu baaxul: Bul musa tëye Win + R -> Ctrl + V -> Enter sudee ab sitweb CAPTCHA, ekraŋ Cloudflare bu baaxul, wala "Defar Mikro / Defar Font" pop-up laaj nga jël benn komand ci sa dialog Run wala Terminal, amul benn sitweb bu baax ci kaw suuf bu musa xool nit ñi ci laaj nga jël kode ci Win + R wala terminaal macOS.
• **Jëfandikool caabi kaaraange aparey (YubiKey) wala caabi jàll + Laaj leeralwaat ngir jëf yu am solo **: Bi kuki sesioŋ yiñ sàcc di romb laajtu dugg bu njëkk bi, platform yu mag yi (Google, GitHub, Cloudflare, AWS, Coinbase) dafay laaj FIDO2 YubiKey physique wala Passkey biometric check balaa ngay may képp ku am kukiis sesioŋ mu soppi sa baatu-jàll, yóbbu ay done, wala yokk adres dindi.
• Xool ndax sa imeel wala sa journal sàcc feeñ nañu ci Base de done yiy saytu Darknet: Seetal haveibeenpwned.com (leegi dafay indexe ay milioŋ ciy adres email victim log sàcc ak domen yuñ laal) ak may yëgle darknet bu amul fey ngir sa adres email.
• **Sàjjale yebbi yi nga wóoluwul, mods jeu yi, ak script yu ñeneen ci biir masin virtuel wala Windows Sandbox **: Bul musa daw te kenn xamul .exe, .msi, .dmg, .bat, wala Python pip / Node npm post-install scripts ci sistem operaasioŋ bi yor sa sesioŋ navigateur web ak sa dugg ci xaalis. Aktiwiseel Windows Sandbox (ñu tabax ko ci Windows 10/11 Pro ak Enterprise jaaraleko ci Taalal wala fay man-mani Windows > Windows Sandbox) wala nga jëfandikoo masin virtuel bu amul benn kuki nawigatër buñ denc sooy saytu yeneen utilite.

Laaj yi ñuy faral di laaj¶

Gid yu jëm ci loolu¶

• Infeksioŋu losisel bu bonn, losisel ransom, ak espion
• MFA phishing ak noon-ci-digg (AiTM) bypass
• MFA lockout: ni ñuy defaraat kontu yiñ tëj
• Kontu imeel biñ pirate, sàrti yebal, ak defaraat
• Cryptocurrency portefeylu drein ak jiwwu frase kompromis
• tëjug njiitu baatu-jàll ak defaraat coffre d'urgence
• Annuaire numéro d'urgence

Saytu nañu ay balluwaay¶

• Kaaraange siber ak kuréel gi yor kaaraange jumtukaay (CISA) ak FBI (Etats Unis): Njàngale ci wàllu kaaraange siber ci wàllu sàcc xibaar (LummaC2, RedLine, Rhadamanthys) ak sàcc token/sesioŋ buy wàññi (CSAE24 / MITRE ATT&CK Webs1539: Kuki sesioŋ).
• Daara bu mag biy saytu ni ñuy doxalee ak xarala yu bees yi (NIST) (Etats Unis): NIST SP 800-63B: Njàngaley dàntite numérik: Doxal sesioŋ yi, xamlewaat, ak lëkkale ay token.
• Mbootaayu Web Àdduna (W3C) & Arsitektu Kaaraange Google Chromium: Njàngalem sesioŋ buñ tënk ci aparey (DBSC) ak enkripsioŋ buñ tënk ci aplikaasioŋu Chrome (v20 DPAPI Kawewaay) Këyitu Xarala.
• Centre National de Sécurité Cyber ​​(NCSC) (Royaume-Uni): Dafay wàññi loraange yu bonn yi, sàcc xibaar yi, ak jàpp sesioŋ ci environmaa liggéeyukaay yi ak konsomatër yi.
• Ubbi projet kaaraange aplikaasioŋ ci àdduna bi yépp (OWASP): Fiche de cheat de gestion de session & OAuth 2.0 dindi token (RFC 7009) Norme.