Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Credential Access/ T1539

T1539Steal Web Session Cookie

T1539 — Steal Web Session Cookie is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 20 detection use cases covering it and 147 threat-intel articles citing it.

Credential Access
View on the matrix → Filter Detection Library MITRE official spec ↗
20Use cases
147Articles
0Sub-techniques
1Tactic

Use cases covering this technique (20)

Infostealer — non-browser process accessing browser cookie/login DBs Internal actions · alerting DSΣP [WEEKLY] Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN Internal actions · alerting DSP [WEEKLY] Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes Internal actions · alerting DSPDD [WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD Okta Suspicious Use of a Session Cookie ESCU actions · hunting P [LLM] AmnesiaStealer stream_module: headless Chromium launched with remote-debugging + hardening-off flags Bespoke actions · alerting DSΣPCS [LLM] Evooo1Bot credential sniffer artifact (/tmp/.sniff.log capture file) Bespoke actions · alerting DSΣPCS [LLM] Suspicious ProcessAccess to chrome.exe / msedge.exe with injection-grade rights Bespoke actions · alerting DSΣPDD [LLM] macOS headless Chromium launched with remote-debugging (CDP browser hijack) Bespoke actions · alerting DSΣPCS [LLM] Still Sync Telegram tdata theft via non-Telegram process + SeBackupPrivilege abuse Bespoke actions · hunting DSΣPDDCS [LLM] AitM session hijack: PaaS phishing-page visit followed by successful Entra sign-in from a different IP Bespoke actions · alerting DS [LLM] Endpoint connections to Storm-2945 CaptiveCrunch AiTM doppelganger infrastructure Bespoke c2 · hunting DSΣPDDCS [LLM] Browser-initiated webmail data exfiltration to CL-STA-1114 C2 Bespoke actions · hunting DSΣPDDCS [LLM] Gitea artifact HMAC signature reused across mismatched task/artifact tuples (CVE-2026-58426) Bespoke exploit · alerting SP [LLM] Cyberhaven trojanized Chrome extension C2 callback to cyberhavenext.pro Bespoke c2 · alerting DSΣPDDCS [LLM] Burst credential-file harvest by VS Code / node process (Nx Console stealer behaviour) Bespoke actions · hunting DSPDDCS [LLM] Cyberhaven compromised extension C2 beacon to cyberhavenext[.]pro Bespoke c2 · hunting DSΣPDDCS [LLM] Mailcow login with HTML/JS injected into X-Real-IP header (GHSA-jprq-w83q-q62h) Bespoke delivery · alerting SPDD [LLM] PTX-Player macOS infostealer artifacts (SHA256 + dropped /private/tmp logs) Bespoke install · hunting DSΣPCS [LLM] Discord client tampering via index.js overwrite in discord_desktop_core (Discord Injector) Bespoke install · alerting DSΣPDDCS

Articles citing this technique (147)

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE art-03
crit Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects art-05
high Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection art-08
crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10
crit Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access art-23
crit Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies art-25
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
crit New AmnesiaStealer macOS malware hijacks browser sessions via remote control art-33
crit New Evooo1Bot Linux botnet turns routers into traffic relay nodes art-36
crit SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch art-37
crit Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner art-38
high Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware art-40
high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth art-43
high Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers art-44
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps art-45
high Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware art-46
crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud art-49
high GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE art-50
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories art-51
crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure art-53
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS art-55
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud art-58
crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring art-59
crit Dissecting the JWR phishing framework art-60
high Armored Likho expands its cyber-espionage toolkit art-62
crit Attackers Exploit SharePoint Authentication Bypass After Public PoC Release art-63
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64
high 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One art-66
high OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning art-69
crit Enterprise Defenses Recovered at the Edge and Collapsed Inside art-70
crit Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws art-71
crit Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access art-72
crit Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations art-73
crit SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code art-74
crit ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access art-75
crit Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS art-76
high Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing art-79
crit Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client art-80
crit Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands art-81
high DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt art-82
crit OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development art-84
crit A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices art-85
crit Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo art-86
crit Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers art-88
high Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 art-89
high Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets art-90
crit Kimwolf v7: An Evolution of the Kimwolf Botnet art-92
crit The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications art-96
high Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise art-97
crit IT threat evolution in Q2 2026. Non-mobile statistics art-99
crit Inside the Modern SOC: The Identity Front Door art-102
crit [GHSA / CRITICAL] GHSA-wg23-69c2-gjc8: Craft CMS: Passkey login accepts replayed WebAuthn assertions art-106
crit ChainDrop: Inside a Self-Propagating npm Worm art-108
high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources art-112
crit From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide art-116
high Almost Half of Malware Samples Communicate Direct to IP art-132
crit How legitimate cloud platforms enable phishers to bypass MFA art-133
high Keyv and friends compromised in active Shai-Hulud supply chain attack art-134
crit Pass the Passkey: A Novel Attack Surface in Passwordless Authentication art-147
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version art-160
crit Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan art-163
crit Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks art-170
crit 2026 Mid-Year Update: On Pace for Our Biggest Year Yet art-182
crit Russian Global Webmail Espionage art-217
crit [GHSA / CRITICAL] CVE-2026-58426: Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task art-229
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-263
crit [GHSA / CRITICAL] CVE-2026-47156: MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator art-266
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-267
high AsyncAPI npm packages backdoored via GitHub Actions art-276
crit What is a dependency firewall? art-287
crit jscrambler npm package publishes malicious preinstall binary art-290
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-291
crit [GHSA / CRITICAL] CVE-2026-54069: SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist art-300
crit [GHSA / CRITICAL] CVE-2026-52777: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize art-306
crit Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry art-308
crit ESET Threat Report H1 2026 art-312
high 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers art-332
high Top Koi alternatives in 2026 art-341
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-344
high Everybody's shipping code they can't read art-345
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-349
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-352
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-364
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-370
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-373
high Multiple JetBrains IDE plugins caught stealing AI keys art-374
high npm v12 delivers one of the biggest security improvements in years art-385
crit Compromised Rust crate onering performs code exfiltration art-392
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System art-398
crit Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm art-425
high What MDM can't protect on developer machines (and what to do about it) art-432
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-434
high Why developer machines are now the number one target for supply chain attacks art-442
crit Laravel Lang Supply Chain Advisory art-445
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-446
high Dev Machine Guard Now Supports Linux art-456
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-457
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-458
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-468
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-469
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-471
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-483
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-486
crit Security metamorphosis: a Mythos-ready architecture checklist for autonomous AI attacks art-499
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-502
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-504
high Popular PyTorch Lightning Package Compromised by Mini Shai-Hulud art-507
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-513
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-515
high It's time to treat browser extensions like supply chain attack vectors art-522
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-528
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-534
high Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow art-546
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-562
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-568
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-570
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-572
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-577
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
high Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags art-591
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-593
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-597
crit How SMBs use threat research and MDR to build a defensive edge art-634
crit Protecting education: How MDR can tip the balance in favor of schools art-640
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-673
crit ESET Threat Report H2 2025 art-762
high npm Supply Chain Attack via Open Source maintainer compromise art-878
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-888
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-924
high Lottie Player npm package compromised for crypto wallet theft art-1191
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1319
crit Exploring WebExtension security vulnerabilities in React Developer Tools and Vue.js devtools art-1506
high XS leaks: What they are and how to avoid them art-1663
med Security implications of HTTP response headers art-1766
high Preventing XSS in Django art-1837
high Comparing Node.js web frameworks: Which is most secure? art-1841
high Supply chain security incident at CircleCI: Rotate your secrets art-1895
med You should be using HTTP Strict Transport Security (HSTS) headers in your Node.js server art-1897
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2095
high Java Top 10 Security Vulnerabilities Disclosed [2019 - List] art-3539
high The most common vulnerabilities in Maven Central and npm art-3628
med Snyk is Now Integrated with Chrome’s Lighthouse art-3637
crit XSS Attacks: The Next Wave art-3664