Steal Web Session Cookie

discovered 2025-04-23

Harvests browser cookies (Network/Cookies, encrypted cookie values) and Local Storage/leveldb across 27+ Chromium/Firefox variants including Flatpak/Snap, plus Slack/Teams/Discord/Telegram stores.

View on MITRE ATT&CK

Seen in packages

npmexpress-cookie-parseruses
npmexpress-session-jsuses
npmjs-logger-packuses
npmixpresso-coreuses
npmgodsplanuses
npmeyevoxuses
npmexioussuses
npmcommon-tg-serviceuses
npmams-sskuses
npmnode-env-resolveuses
npm@beproduct/nestjs-authuses
npm@dirigible-ai/sdkuses
npm@draftauth/clientuses
npm@draftauth/coreuses
npm@draftlab/authuses
npm@draftlab/auth-routeruses
npm@draftlab/dbuses
npm@mesadev/restuses
npm@mesadev/saguarouses
npm@mesadev/sdkuses
npm@mistralai/mistralaiuses
npm@mistralai/mistralai-azureuses
npm@mistralai/mistralai-gcpuses
npm@ml-toolkit-ts/preprocessinguses
npm@ml-toolkit-ts/xgboostuses
npm@opensearch-project/opensearchuses
npm@squawk/airport-datauses
npm@squawk/airportsuses
npm@squawk/airspaceuses
npm@squawk/airspace-datauses
npm@squawk/airway-datauses
npm@squawk/airwaysuses
npm@squawk/fix-datauses
npm@squawk/fixesuses
npm@squawk/flight-mathuses
npm@squawk/flightplanuses
npm@squawk/geouses
npm@squawk/icao-registryuses
npm@squawk/icao-registry-datauses
npm@squawk/mcpuses
npm@squawk/navaid-datauses
npm@squawk/navaidsuses
npm@squawk/notamsuses
npm@squawk/procedure-datauses
npm@squawk/proceduresuses
npm@squawk/typesuses
npm@squawk/unitsuses
npm@squawk/weatheruses
npm@supersurkhet/cliuses
npm@supersurkhet/sdkuses
npm@tallyui/componentsuses
npm@tallyui/connector-medusauses
npm@tallyui/connector-shopifyuses
npm@tallyui/connector-vendureuses
npm@tallyui/connector-woocommerceuses
npm@tallyui/coreuses
npm@tallyui/databaseuses
npm@tallyui/posuses
npm@tallyui/storage-sqliteuses
npm@tallyui/themeuses
npm@tanstack/arktype-adapteruses
npm@tanstack/eslint-plugin-routeruses
npm@tanstack/eslint-plugin-startuses
npm@tanstack/historyuses
npm@tanstack/nitro-v2-vite-pluginuses
npm@tanstack/react-routeruses
npm@tanstack/react-router-devtoolsuses
npm@tanstack/react-router-ssr-queryuses
npm@tanstack/react-startuses
npm@tanstack/react-start-clientuses
npm@tanstack/react-start-rscuses
npm@tanstack/react-start-serveruses
npm@tanstack/router-cliuses
npm@tanstack/router-coreuses
npm@tanstack/router-devtoolsuses
npm@tanstack/router-devtools-coreuses
npm@tanstack/router-generatoruses
npm@tanstack/router-pluginuses
npm@tanstack/router-ssr-query-coreuses
npm@tanstack/router-utilsuses
npm@tanstack/router-vite-pluginuses
npm@tanstack/solid-routeruses
npm@tanstack/solid-router-devtoolsuses
npm@tanstack/solid-router-ssr-queryuses
npm@tanstack/solid-startuses
npm@tanstack/solid-start-clientuses
npm@tanstack/solid-start-serveruses
npm@tanstack/start-client-coreuses
npm@tanstack/start-fn-stubsuses
npm@tanstack/start-plugin-coreuses
npm@tanstack/start-server-coreuses
npm@tanstack/start-static-server-functionsuses
npm@tanstack/start-storage-contextuses
npm@tanstack/valibot-adapteruses
npm@tanstack/virtual-file-routesuses
npm@tanstack/vue-routeruses
npm@tanstack/vue-router-devtoolsuses
npm@tanstack/vue-router-ssr-queryuses
npm@tanstack/vue-startuses
npm@tanstack/vue-start-clientuses
npm@tanstack/vue-start-serveruses
npm@tanstack/zod-adapteruses
npm@taskflow-corp/cliuses
npm@tolka/cliuses
npm@uipath/access-policy-sdkuses
npm@uipath/access-policy-tooluses
npm@uipath/admin-tooluses
npm@uipath/agent-sdkuses
npm@uipath/agent-tooluses
npm@uipath/agent.sdkuses
npm@uipath/aops-policy-tooluses
npm@uipath/ap-chatuses
npm@uipath/api-workflow-tooluses
npm@uipath/apollo-coreuses
npm@uipath/apollo-reactuses
npm@uipath/apollo-winduses
npm@uipath/authuses
npm@uipath/case-tooluses
npm@uipath/cliuses
npm@uipath/codedagent-tooluses
npm@uipath/codedagents-tooluses
npm@uipath/codedapp-tooluses
npm@uipath/commonuses
npm@uipath/context-grounding-tooluses
npm@uipath/data-fabric-tooluses
npm@uipath/docsai-tooluses
npm@uipath/filesystemuses
npm@uipath/flow-tooluses
npm@uipath/functions-tooluses
npm@uipath/gov-tooluses
npm@uipath/identity-tooluses
npm@uipath/insights-sdkuses
npm@uipath/insights-tooluses
npm@uipath/integrationservice-sdkuses
npm@uipath/integrationservice-tooluses
npm@uipath/llmgw-tooluses
npm@uipath/maestro-sdkuses
npm@uipath/maestro-tooluses
npm@uipath/orchestrator-tooluses
npm@uipath/packager-tool-apiworkflowuses
npm@uipath/packager-tool-bpmnuses
npm@uipath/packager-tool-caseuses
npm@uipath/packager-tool-connectoruses
npm@uipath/packager-tool-flowuses
npm@uipath/packager-tool-functionsuses
npm@uipath/packager-tool-webappuses
npm@uipath/packager-tool-workflowcompileruses
npm@uipath/packager-tool-workflowcompiler-browseruses
npm@uipath/platform-tooluses
npm@uipath/project-packageruses
npm@uipath/resource-tooluses
npm@uipath/resourcecatalog-tooluses
npm@uipath/resources-tooluses
npm@uipath/robotuses
npm@uipath/rpa-legacy-tooluses
npm@uipath/rpa-tooluses
npm@uipath/solution-packageruses
npm@uipath/solution-tooluses
npm@uipath/solutionpackager-sdkuses
npm@uipath/solutionpackager-tool-coreuses
npm@uipath/tasks-tooluses
npm@uipath/telemetryuses
npm@uipath/test-manager-tooluses
npm@uipath/tool-workflowcompileruses
npm@uipath/traces-tooluses
npm@uipath/ui-widgets-multi-file-uploaduses
npm@uipath/uipath-python-bridgeuses
npm@uipath/vertical-solutions-tooluses
npm@uipath/vssuses
npm@uipath/widget.sdkuses
npmagentwork-cliuses
npmcmux-agent-mcpuses
npmcross-stitchuses
npmgit-branch-selectoruses
npmgit-git-gituses
npmml-toolkit-tsuses
npmnextmove-mcpuses
npmsafe-actionuses
npmts-dnauses
npmwot-apiuses
pypiguardrails-aiuses
pypimistralaiuses
npmiceberg-javascriptuses
npmsupabase-javascriptuses
npmauth-javascriptuses
npmmicrosoft-applicationinsights-commonuses
npmms-graph-typesuses
npmfaster-axiosuses
npmatomic-lockfileuses
npm@apexcraft/nano-keyuses
npmjscrambleruses
npm@copilot-mcp/apexuses

Campaigns

No Specific Campaignattributed-to
Contagious Interviewattributed-to
fucktestpad npm Malwareattributed-to
shetty123 Telegram Hijackattributed-to
tanvisoul9 npm Backdoorsattributed-to
Mini Shai-Huludattributed-to
Claude Code Hook Backdoorsattributed-to
Epsilon Axios Typosquat Campaignattributed-to
Atomic Archattributed-to
wshu.net npm Credential-Stealer Campaignattributed-to
Apex Foundationattributed-to

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API