Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: Medium
Victim: Windows users running Google Chrome or Microsoft Edge
Incident: Discovery of a post-exploitation technique to enable the Chrome DevTools Protocol for session hijacking.
Impact: Unauthorized access to authenticated browser sessions and theft of encrypted cookies.
Attacker: Unidentified threat actors
Analysis: The technique utilizes a Beacon Object File (BOF) to activate the Chrome DevTools Protocol (CDP) within a live browser process on Windows x64 systems. By triggering internal Chromium functions, attackers can bypass App-Bound Encryption to extract cookies and hijack active sessions. This method assumes the attacker has already achieved code execution on the host machine.
Recommendations: Monitor Sysmon Event IDs 8 and 10 for suspicious process injection into chrome.exe and msedge.exe; Deploy EDR rules to detect unauthorized remote memory allocation and thread execution within browser processes; Implement short-lived session tokens and mandatory MFA to reduce the utility of stolen cookies
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source