Researchers Turn Infostealer Gangs' Own Supply Chain Against Them With Decoy Session Cookies

Two New Zealand security researchers, Will Frame of the Restealer monitoring service and Jacob Torrey of Thinkst Applied Research, deliberately infected themselves with infostealer malware. Their aim was to plant decoy session cookies in the databases of infostealer operators. They built a new type of Canarytoken from session cookies, which acts like a motion sensor that raises an alarm when something is accessed, and handed free samples to every operator they could find. The criminals' own supply chain then became a tracking network.

Session cookies are prized because they let an attacker step into an account that has already passed a multifactor authentication check. The researchers said this is a common attacker tactic. Their findings also show what happens to stolen data afterwards. They observed a window of roughly three days after compromise where nothing happens, followed by a few initial checks to see if the credentials are valid. Login attempts then shoot up once the data has been sold.

Frame said those early checks are almost certainly log providers inspecting the contents before releasing them to subscribers. If a log leads to a real business, the provider could sell that access separately for a higher price or pass it to others in their team. Frame also said access to compromised corporate virtual machines or AWS and Azure portals is often available through the provider channels themselves, and the wider trade runs largely on subscriptions.