The silent “Storm”: New infostealer hijacks sessions, decrypts server-side
Storm infostealer performs server-side credential decryption and session hijacking, bypassing endpoint detection.
Storm, a new infostealer malware sold on underground forums for $300–$1,800/month, harvests browser credentials, session cookies, and crypto wallet data, then decrypts everything server-side to evade endpoint security tools. Unlike traditional stealers that decrypt locally, Storm ships encrypted data to attacker infrastructure, then automatically restores hijacked sessions without requiring passwords or triggering MFA alerts. Active campaigns have targeted victims across India, the US, Brazil, Indonesia, Ecuador, Vietnam, and other countries, with stolen credentials for Google, Facebook, Twitter/X, and major crypto exchanges already appearing on dark web marketplaces.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonStorm malware represents a new evolution in credential theft by encrypting stolen data locally and decrypting it server-side, effectively bypassing traditional endpoint security tools. The malware's ability to hijack active sessions without triggering MFA alerts demonstrates how attackers are adapting to modern security controls. This technique allows cybercriminals to gain immediate access to accounts across major platforms including social media and cryptocurrency exchanges, making detection and response significantly more challenging.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Storm
- malware — StealC V2