[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9QrjTCaWmlQaUr6SqV6b5HEwwIltlUuMKsWDO5EL1bw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":18,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39,"controls":40},"272c8667-62d5-4864-872f-efe05438c740","storm-infostealer-evades-detection-through-server-side-decryption","abf01874-1fcd-455d-88c1-99bbbf5550f1","Storm Infostealer Evades Detection Through Server-Side Decryption","Storm malware represents a new evolution in credential theft by encrypting stolen data locally and decrypting it server-side, effectively bypassing traditional endpoint security tools. The malware's ability to hijack active sessions without triggering MFA alerts demonstrates how attackers are adapting to modern security controls. This technique allows cybercriminals to gain immediate access to accounts across major platforms including social media and cryptocurrency exchanges, making detection and response significantly more challenging.","**Immediate actions:**\n- Enable advanced browser security features and regularly clear stored credentials and cookies\n- Implement additional verification steps for high-value account access beyond standard MFA\n- Deploy behavioral analytics to detect unusual session patterns and login anomalies\n\n**Long-term improvements:**\n- Establish comprehensive endpoint detection and response (EDR) solutions with behavioral monitoring\n- Implement zero-trust architecture with continuous session validation\n- Regular security awareness training focused on social engineering and malware delivery methods\n\n**Detection measures:**\n- Monitor for unusual data exfiltration patterns and encrypted traffic to suspicious destinations\n- Set up alerts for simultaneous logins from different geographical locations\n- Implement session timeout policies and re-authentication requirements for sensitive operations",[12,13,14,15,16,17],"CIS Control 6","CIS Control 7","NIST AC-7","NIST AC-12","NIST SI-4","GDPR Article 32",{},"published","2026-04-13T19:09:44.807392+00:00","2026-04-13T19:09:44.657+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fthe-silent-storm-new-infostealer-hijacks-sessions-decrypts-server-side\u002F","the-silent-storm-new-infostealer-hijacks-sessions-decrypts-server-side-d0e022","The silent “Storm”: New infostealer hijacks sessions, decrypts server-side",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":34,"name":35,"slug":36,"description":37,"color":38},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[41,45,49],{"slug":42,"name":43,"problem":44},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":46,"name":47,"problem":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]