Procedure examples

BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.

RedLine Stealer has stolen browser cookies and settings.

Grandoreiro can steal the victim's cookies to use for duplicating the active session from another device.

XLoader can capture web session cookies and session information from victim browsers.

MgBot includes modules that can steal cookies from Firefox, Chrome, and Edge web browsers.

TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.

Raccoon Stealer attempts to steal cookies and related information in browser history.

XCSSET uses scp to access the ~/Library/Cookies/Cookies.binarycookies file.

QakBot has the ability to capture web session cookies.

CookieMiner can steal Google Chrome and Apple Safari browser cookies from the victim’s machine.

evilginx2 can collect information on each session with a victim including the session cookie.

Kali365 has captured session cookies and related session artifacts when the interacted phishing lure acts as proxy for legitimate requests with login services.

Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.

LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.

Trojan.Mebromi performs BIOS modification and can download and execute a file as well as protect itself from removal.

Cyclops Blink has maintained persistence by patching legitimate device firmware when it is downloaded, including that of WatchGuard devices.

TrickBot can implant malicious code into a compromised device's firmware.

WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.

Some FinFisher variants incorporate an MBR rootkit.

Carberp has installed a bootkit on the system to maintain persistence.

ROCKBOOT is a Master Boot Record (MBR) bootkit that uses the MBR to establish persistence.

BOOTRASH is a Volume Boot Record (VBR) bootkit that uses the VBR to maintain persistence.

BRICKSTORM has created a new background session and has spawned a child process of a parent process when it determines it is not running in its intended state.

Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.

LITTLELAMB.WOOLTEA can initialize itself as a daemon to run persistently in the background.

IMAPLoader modifies Windows tasks on the victim machine to reference a retrieved PE file through a path modification.

BOLDMOVE can free all resources and terminate itself on victim machines.

Akira _v2 can create a child process for encryption.

LunarMail can create an arbitrary process with a specified command line and redirect its output to a staging directory.

CanisterWorm can establish persistence in CI/CD environments by launching a background process (deploy.js) with stolen tokens.

InvisibleFerret has established persistence using LaunchAgents on macOS that run on Startup using a file named “com.avatar.update.wake.plist”.

macOS.OSAMiner has placed a Stripped Payloads with a `plist` extension in the Launch Agent's folder.

NETWIRE can use launch agents for persistence.

Dacls can establish persistence via a LaunchAgent.

Cuckoo Stealer can achieve persistence by creating launch agents to repeatedly execute malicious payloads.

FruitFly persists via a Launch Agent.

Keydnap uses a Launch Agent to persist.

Green Lambert can create a Launch Agent with the `RunAtLoad` key-value pair set to true, ensuring the `com.apple.GrowlHelper.plist` file runs every time a user logs in.

ThiefQuest installs a launch item using an embedded encrypted launch agent property list template. The plist file is installed in the ~/Library/LaunchAgents/ folder and configured with the path to the persistent binary located in the ~/Library/ folder.

Bundlore can persist via a LaunchAgent.

GlassWorm has established persistence on macOS via a LaunchAgent by writing a plist under `/library/LaunchAgents`.

CrossRAT creates a Launch Agent on macOS.

OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchAgents.

Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.

MacMa installs a `com.apple.softwareupdate.plist` file in the `/LaunchAgents` folder with the `RunAtLoad` value set to `true`. Upon user login, MacMa is executed from `/var/root/.local/softwareupdate` with root privileges. Some variations also include the `LimitLoadToSessionType` key with the value `Aqua`, ensuring the MacMa only runs when there is a logged in GUI user.

Proton persists via Launch Agent.

CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.

CookieMiner has installed multiple new Launch Agents in order to maintain persistence for cryptocurrency mining software.

The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.

Dok installs two LaunchAgents to redirect all network traffic with a randomly generated name for each plist file maintaining the format com.random.name.plist.