Procedure examples

TRANSLATEXT has exfiltrated updated cookies from Google, Naver, Kakao or Daum to the C2 server.

Lumma Stealer has harvested cookies from various browsers.

DarkGate attempts to steal Opera cookies, if present, after terminating the related process.

Chaes has used a script that extracts the web session cookie and sends it to the C2 server.

LODEINFO can list the contents of `%LocalAppData%\Google\Chrome\User Data\` and `%LocalAppData%\Microsoft\Edge\User Data\` to obtain cookies.

EVILNUM can harvest cookies and upload them to the C2 server.

GlassWorm has harvested Safari cookies stored within `/Library/Containers/com.apple.Safari/Data/Library/Cookies/ Cookies.binarycookies`. GlassWorm has also stolen cookies within Chromium and Firefox browsers.

Spica has the ability to steal cookies from Chrome, Firefox, Opera, and Edge browsers.

BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.

RedLine Stealer has stolen browser cookies and settings.

Grandoreiro can steal the victim's cookies to use for duplicating the active session from another device.

XLoader can capture web session cookies and session information from victim browsers.

MgBot includes modules that can steal cookies from Firefox, Chrome, and Edge web browsers.

TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.

Raccoon Stealer attempts to steal cookies and related information in browser history.

XCSSET uses scp to access the ~/Library/Cookies/Cookies.binarycookies file.

QakBot has the ability to capture web session cookies.

CookieMiner can steal Google Chrome and Apple Safari browser cookies from the victim’s machine.

evilginx2 can collect information on each session with a victim including the session cookie.

Kali365 has captured session cookies and related session artifacts when the interacted phishing lure acts as proxy for legitimate requests with login services.