[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fysylSEQmabSYQ0gf2-8urd2sEga-Gn1mv_QKDyhPoMs":3},{"article":4,"iocs":50,"watch_terms":57,"solutions":58,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"abf01874-1fcd-455d-88c1-99bbbf5550f1","The silent “Storm”: New infostealer hijacks sessions, decrypts server-side","the-silent-storm-new-infostealer-hijacks-sessions-decrypts-server-side-d0e022","New \"Storm\" infostealer skips local decryption, sending browser data to attacker servers. Varonis shows how server-side decryption enables session hijacking, bypassing passwords and MFA. [...]","Storm, a new infostealer malware sold on underground forums for $300–$1,800\u002Fmonth, harvests browser credentials, session cookies, and crypto wallet data, then decrypts everything server-side to evade endpoint security tools. Unlike traditional stealers that decrypt locally, Storm ships encrypted data to attacker infrastructure, then automatically restores hijacked sessions without requiring passwords or triggering MFA alerts. Active campaigns have targeted victims across India, the US, Brazil, Indonesia, Ecuador, Vietnam, and other countries, with stolen credentials for Google, Facebook, Twitter\u002FX, and major crypto exchanges already appearing on dark web marketplaces.","Storm infostealer performs server-side credential decryption and session hijacking, bypassing endpoint detection.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fthe-silent-storm-new-infostealer-hijacks-sessions-decrypts-server-side\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F04\u002F08\u002Fstorm-cloud-infostealer.jpg","2026-04-13T14:05:15+00:00","2026-04-13T16:00:20.252814+00:00",9,[17,20,22,25],{"name":18,"type":19},"Varonis","vendor",{"name":21,"type":19},"Google",{"name":23,"type":24},"Chrome App-Bound Encryption","technology",{"name":26,"type":24},"Azure Entra ID","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,54],{"type":31,"value":52,"context":53},"Storm","New infostealer malware performing server-side credential decryption and session hijacking",{"type":31,"value":55,"context":56},"StealC V2","Predecessor stealer that still processes Firefox credentials locally; Storm improves on this approach",[21,18],{"controls":59,"vendors":144},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":119,"name":120,"problem":121,"products":122},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[123,131,136],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":132,"product_name":133,"url":134,"description":135},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":156},"storm-infostealer-evades-detection-through-server-side-decryption","Storm Infostealer Evades Detection Through Server-Side Decryption","Storm malware represents a new evolution in credential theft by encrypting stolen data locally and decrypting it server-side, effectively bypassing traditional endpoint security tools. The malware's ability to hijack active sessions without triggering MFA alerts demonstrates how attackers are adapting to modern security controls. This technique allows cybercriminals to gain immediate access to accounts across major platforms including social media and cryptocurrency exchanges, making detection and response significantly more challenging.",[150,151,152,153,154,155],"CIS Control 6","CIS Control 7","NIST AC-7","NIST AC-12","NIST SI-4","GDPR Article 32",{}]