Researchers feed infostealer gangs booby-trapped session cookies

Two Kiwi security researchers deliberately infected themselves with malware to plant decoy session cookies in infostealer operators' databases, and then used the criminals' suppy chain as a tracking network.

Will Frame, who runs the free Restealer infostealer monitoring service and Jacob Torrey, head of labs at Thinkst Applied Research, created a new type of Canarytoken built from session cookies and handed out free samples to every infostealer operator they could find.

They described Canarytokens as being "like motion sensors for your networks, computers and clouds. You can put them in folders, on network devices and on your phones."

"Place them where nobody should be poking around and get a clear alarm if they are accessed."

Existing types of Canarytokens mimic AWS application programming interface keys, Azure Entra ID logins, credit cards and Office documents, among others, but session cookies had not been on the list.

Stolen session cookies, in particular, are prized because they let an attacker step into an account that has already passed a multifactor authentication check.

"We've seen attackers using session cookies, especially if they are prompted for MFA, so it is a common attacker tactic," the researchers told iTnews.

Some of Frame and Torrey's findings show what happens to the stolen data after a compromise.

"There's an [approximately] three day window post-compromise where nothing happens, then a few initial checks to see if the credentials are valid, then you can tell once they've been sold as the login attempts shoot up," the researchers said.

Frame said those early checks were almost certainly the sellers going through their own stock.

"These initial credential checks are almost definitely the result of the log providers checking the contents of the logs before releasing them to their subscribers," Frame said.

"This way, if one of the logs leads to compromise of a real business, they could sell this level of access separately for a higher price or pass it on to other people within their team to investigate further."

That access can later surface as listings for compromised businesses or databases on criminal forums, he said.

"We also see quite often access to compromised corporate VMs or access to AWS/Azure portals is available to purchase through the provider channels themselves," Frame said.

Infostealer marketplace

The trade itself runs largely on subscriptions at both ends.

Log providers typically pay a subscription for an infostealer variant, spread it through infected software or ClickFix attacks, then charge their own customers a subscription for whatever they collect.

Prices vary widely, Frame said, with newcomers holding little data asking as little as US$300 for lifetime access, while larger providers charge between US$5,000 and US$10,000.

At the bottom end, buyers can pay for a single week.

Restealer does not buy the data, gathering it instead from open-source intelligence and leaks from insiders in those channels.

Each log is an archive that can hold passwords, cookies, browsing history, details of the infected machine, process trees captured at the moment of infection, clipboard history, and payment and autofill data.

Because logs are generally sold whole, buyers pay nothing extra for the session cookies inside, despite their value in getting past MFA.

Measuring how large the trade has grown is difficult.

"So many cybercriminals are sharing the same credentials over and over again, after parsing it into different formats, or adding a percentage of false data, so it can be really hard to deduplicate the information," Frame said.

Nor does stolen data keep forever.

"We can actually see the issuance time of certain cookies in these logs and know some of these would become invalid within hours or days after they have been stolen," Frame said.

Organisations that spot suspicious connections, or that monitor for leaked credentials, may revoke them while they investigate.

Buyers left holding dead credentials have little recourse.

"I don't expect refunds would be given out for credentials that become invalid," Frame said.

Frame and Torrey will present the full results of their experiment at the Kawaiicon security conference in Wellington on Friday October 30.