Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Credential Access/ T1539

T1539Steal Web Session Cookie

T1539 — Steal Web Session Cookie is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 16 detection use cases covering it and 115 threat-intel articles citing it.

Credential Access
View on the matrix → Filter Detection Library MITRE official spec ↗
16Use cases
115Articles
0Sub-techniques
1Tactic

Use cases covering this technique (16)

Infostealer — non-browser process accessing browser cookie/login DBs Internal actions · alerting DSΣP [WEEKLY] Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN Internal actions · alerting DSP [WEEKLY] Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes Internal actions · alerting DSPDD [WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD Okta Suspicious Use of a Session Cookie ESCU actions · hunting P [LLM] WScript enumerating browser profiles for Telegram session and wallet extensions Bespoke actions · hunting DSΣPCS [LLM] ChromEggscalator: Chromium launched with --remote-debugging-port for cookie/credential theft Bespoke actions · alerting DSΣPDDCS [LLM] Browser-initiated webmail data exfiltration to CL-STA-1114 C2 Bespoke actions · hunting DSΣPDDCS [LLM] Cyberhaven trojanized Chrome extension C2 callback to cyberhavenext.pro Bespoke c2 · alerting DSΣPDDCS [LLM] Burst credential-file harvest by VS Code / node process (Nx Console stealer behaviour) Bespoke actions · hunting DSPDDCS [LLM] Cyberhaven compromised extension C2 beacon to cyberhavenext[.]pro Bespoke c2 · hunting DSΣPDDCS [LLM] Mailcow login with HTML/JS injected into X-Real-IP header (GHSA-jprq-w83q-q62h) Bespoke delivery · alerting SPDD [LLM] Hoppscotch device-login open redirect token theft via localhost.* / sslip.io bypass Bespoke exploit · alerting DSΣPDDCS [LLM] Non-browser process copying Chrome/Edge/Brave Login Data, Web Data, or wallet extension LevelDB state Bespoke actions · alerting DSΣPDDCS [LLM] PTX-Player macOS infostealer artifacts (SHA256 + dropped /private/tmp logs) Bespoke install · hunting DSΣPCS [LLM] Discord client tampering via index.js overwrite in discord_desktop_core (Discord Injector) Bespoke install · alerting DSΣPDDCS

Articles citing this technique (115)

crit Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js art-30
crit 2026 Mid-Year Update: On Pace for Our Biggest Year Yet art-33
crit Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root art-48
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update art-64
crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-65
high Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable art-71
crit Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available art-72
high Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git art-73
crit CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking art-74
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE art-75
crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts art-76
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-96
crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-97
high ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link art-99
crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry art-102
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants art-103
crit NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats art-104
crit Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say art-105
crit Russian Global Webmail Espionage art-111
high ACR Stealer: Two observed intrusion chains amid increased threat activity art-146
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-163
crit [GHSA / CRITICAL] CVE-2026-47156: MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator art-166
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-168
crit OkoBot: new sophisticated malware framework targets cryptocurrency users art-169
high AsyncAPI npm packages backdoored via GitHub Actions art-181
crit What is a dependency firewall? art-192
crit jscrambler npm package publishes malicious preinstall binary art-195
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-196
crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-198
crit [GHSA / CRITICAL] CVE-2026-54069: SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist art-205
crit [GHSA / CRITICAL] CVE-2026-52777: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize art-211
crit Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry art-215
crit ESET Threat Report H1 2026 art-221
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-223
crit Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign art-250
high 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers art-277
high Top Koi alternatives in 2026 art-290
crit CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure art-293
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-294
high Everybody's shipping code they can't read art-295
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-299
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
crit OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat art-302
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-303
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-316
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-322
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-325
high Multiple JetBrains IDE plugins caught stealing AI keys art-326
high npm v12 delivers one of the biggest security improvements in years art-339
crit Compromised Rust crate onering performs code exfiltration art-346
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System art-352
crit Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm art-379
high What MDM can't protect on developer machines (and what to do about it) art-386
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-388
high Why developer machines are now the number one target for supply chain attacks art-396
crit Laravel Lang Supply Chain Advisory art-399
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-400
high Dev Machine Guard Now Supports Linux art-410
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-411
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-412
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-422
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-423
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-425
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-437
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-440
crit Security metamorphosis: a Mythos-ready architecture checklist for autonomous AI attacks art-454
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-457
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-459
high Popular PyTorch Lightning Package Compromised by Mini Shai-Hulud art-462
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-468
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-469
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-471
high It's time to treat browser extensions like supply chain attack vectors art-477
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-483
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-489
high Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow art-501
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-517
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-523
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-525
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-527
high Aikido Attack finds multiple 0-days in Hoppscotch art-528
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-534
high axios compromised on npm: maintainer account hijacked, RAT deployed art-543
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
crit Popular telnyx package compromised on PyPI by TeamPCP art-547
high Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags art-550
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-552
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-556
high CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran art-566
high TeamPCP deploys CanisterWorm on NPM following Trivy compromise art-567
crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580
crit fast-draft Open VSX Extension Compromised by BlokTrooper art-581
high Glassworm Strikes Popular React Native Phone Number Packages art-587
crit How SMBs use threat research and MDR to build a defensive edge art-601
crit Protecting education: How MDR can tip the balance in favor of schools art-607
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-640
crit ESET Threat Report H2 2025 art-732
high npm Supply Chain Attack via Open Source maintainer compromise art-855
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-865
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-900
high Lottie Player npm package compromised for crypto wallet theft art-1168
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1296
crit Exploring WebExtension security vulnerabilities in React Developer Tools and Vue.js devtools art-1483
high XS leaks: What they are and how to avoid them art-1640
med Security implications of HTTP response headers art-1743
high Preventing XSS in Django art-1814
high Comparing Node.js web frameworks: Which is most secure? art-1818
high Supply chain security incident at CircleCI: Rotate your secrets art-1872
med You should be using HTTP Strict Transport Security (HSTS) headers in your Node.js server art-1874
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2072
high Java Top 10 Security Vulnerabilities Disclosed [2019 - List] art-3516
high The most common vulnerabilities in Maven Central and npm art-3605
med Snyk is Now Integrated with Chrome’s Lighthouse art-3614
crit XSS Attacks: The Next Wave art-3641