← Threat archive

T1539 Steal Web Session Cookie

2 threats tracked by Spectrum Delta use this technique.

T1539 on MITRE ATT&CK →

  • n0n credential extortion

    Chrome driven over DevTools on cloned admin profiles

    Sysmon process-creation events for chrome.exe and netsh portproxy

    Seen in: Sysmon

  • Armorsteal

    Surveillance and harvesting: CDP cookie theft, clipboard address swap, keyword-triggered screenshots, BIP39 drive search

    Endpoint process telemetry: browser process command line containing --remote-debugging-port=9222 (Zscaler MDR WIN-PYTHON-CHROMIUM-HEADLESS); Python processes polling the clipboard at 0.5s and enumerating files across drives; inspected egress: POST /black-watch/, /infame/receive/, /ws/{id}, /pwd; EDR visibility into local port 9222 listening by the browser process

    Seen in: Zscaler Web Insights (inspected), EDR process telemetry