APT42G1044 ↗
Has used custom malware to steal login and cookie data from common browsers.1
tfMITRE ATT&CK technique
Steal Web Session Cookie T1539
- Tactic
- Credential Access
- Platforms
- Linux, macOS, Office Suite, SaaS, Windows
- Version
- 1.5
- Created
- 08 October 2019
- Last modified
- 12 May 2026
- Contributors
- Microsoft Threat Intelligence Center (MSTIC); Johann Rehberger; Menachem Goldstein; Don Le, Stifel Financial
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
8
Threat groupsTop 21%
Threat groups79th percentile · 77% of ATT&CK techniques have fewer threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.20
Tools & malwareTop 17%
Tools & malware83rd percentile · 82% of ATT&CK techniques have fewer tools implementing them.3
Detection rules54th pct
Detection rules54th percentile · 49% of ATT&CK techniques have fewer detection rules written.