Get on Slack/Teams RSS
Last updated: August 19, 2026 at 1:47 AM UTC
All 741 Vulnerability 286 Breach 129 Threat 319 Defense 7
Tag: session-theft (3 articles)Clear
threat
2026-07-14

Exposed server unmasks three Evilginx phishing crews stealing Microsoft 365 sessions

A phishing operator left a Python web server exposed with directory listing on, letting researchers at Lexfo lift the entire toolkit and pivot to two more operators running three Microsoft 365 phishing campaigns. Each used a custom fork of the open-source Evilginx proxy to steal live session cookies and tokens, defeating multi-factor authentication by relaying the real login. The largest campaign ran over a year, logging 218 captured accounts, mostly corporate mailboxes, and a token file left in a public repository held 97 live Microsoft tokens. The report stresses two different MFA-bypass methods appeared, one proxying the real login and one abusing the device-code flow, which require different defenses to stop.

evilginxm365aitmdevice-codesession-theft
Check
Assess your Microsoft 365 defenses against both adversary-in-the-middle proxying and device-code abuse, hunt for suspicious token use and session reuse from unusual locations, and review Conditional Access coverage of the device-code flow.
Affected
Microsoft 365 organizations, especially corporate mailboxes; Evilginx-style proxies steal live session tokens to bypass MFA, and passkeys stop the proxy method but not the separate device-code abuse technique.
Fix
Enforce phishing-resistant authentication like passkeys against proxy phishing, use Conditional Access to block or limit the device-code flow, revoke suspicious sessions and tokens, and monitor sign-in logs for token reuse across locations.
threat
2026-06-26

Bluekit phishing service adds browser-in-the-middle to steal logins and sessions

The Bluekit phishing-as-a-service platform has added a browser-in-the-middle technique that streams a real login page's contents to the victim over a WebSocket, capturing not just passwords but session cookies that let attackers bypass multi-factor authentication. Netcraft reports nearly 70 new Bluekit hostnames in the past week. The kit, which markets dozens of templates for services like Outlook, Gmail, GitHub, and crypto wallets and includes an AI assistant built on a safety-stripped open-weight model, layers on heavy evasion: randomized page styling to defeat screenshot detection, frequently rotating obfuscated code, custom CAPTCHAs, browser fingerprinting, and detection of proxies and security crawlers. Operators can watch victims in real time as they log in.

bluekitphishing-as-a-servicebrowser-in-the-middlemfa-bypasssession-theft
Check
Hunt for the Bluekit signals Netcraft lists, including randomized CSS filters on top-level elements, periodically rotated obfuscated JavaScript, and WebSocket traffic carrying encrypted data on login pages, across email and proxy logs.
Affected
Users of widely targeted services like Outlook, Gmail, GitHub, and crypto wallets; stolen session cookies let attackers replay authenticated sessions and bypass multi-factor authentication entirely.
Fix
Move to phishing-resistant, hardware-backed authentication like passkeys or FIDO2 keys, which resist session-theft phishing, shorten session lifetimes, monitor for anomalous session reuse, and train staff on login-page verification.
threat
2026-05-16

REMUS infostealer profiled - 64-bit Lumma successor with EtherHiding C2 and Chromium ABE bypass

Flare published a deep profile of REMUS, the 64-bit infostealer that emerged in early 2026 after Lumma Stealer's core operators were doxxed in late 2025. Gen Threat Labs links REMUS directly to Lumma's codebase through 'Tenzor' transitional builds from September 2025, identical string obfuscation, anti-VM checks via cpuid leaf 0x40000000, and a refined Application-Bound Encryption bypass for Chromium browsers. The malware harvests browser passwords, cookies, autofill, crypto wallets, and clipboard data, and uses EtherHiding (blockchain-based C2 resolution) for resilience. Flare's 128-post analysis of REMUS forum activity from Feb 12 to May 8 shows the operation has moved from rapid feature expansion into platform stabilization, with active customer-facing MaaS development.

remusinfostealerlumma-successormaassession-theftetherhidingabe-bypasschromiumflaregen-threat-labs
Check
Hunt for processes reading Chromium browser process memory to extract master keys, look for outbound traffic resolving C2 through Ethereum or other blockchain RPC endpoints (EtherHiding), and review browser cookie store access patterns.
Affected
Enterprises with users running Chromium-based browsers (Chrome, Edge, Brave) and saved passwords or session cookies. Crypto-holding individuals and finance, accounting, and developer roles with broad SaaS account access face elevated session-theft risk.
Fix
Roll out Application-Bound Encryption hardening on managed Chromium browsers, enforce conditional access with continuous access evaluation to invalidate stolen sessions, block known REMUS C2 indicators, and replace browser-stored passwords with an enterprise password manager.