T1539
Steal Web Session Cookie
discovered 2025-04-23Harvests browser cookies (Network/Cookies, encrypted cookie values) and Local Storage/leveldb across 27+ Chromium/Firefox variants including Flatpak/Snap, plus Slack/Teams/Discord/Telegram stores.
View on MITRE ATT&CKSeen in packages
- npm express-cookie-parseruses
- npm express-session-jsuses
- npm js-logger-packuses
- npm ixpresso-coreuses
- npm godsplanuses
- npm eyevoxuses
- npm exioussuses
- npm common-tg-serviceuses
- npm ams-sskuses
- npm node-env-resolveuses
- npm @beproduct/nestjs-authuses
- npm @dirigible-ai/sdkuses
- npm @draftauth/clientuses
- npm @draftauth/coreuses
- npm @draftlab/authuses
- npm @draftlab/auth-routeruses
- npm @draftlab/dbuses
- npm @mesadev/restuses
- npm @mesadev/saguarouses
- npm @mesadev/sdkuses
- npm @mistralai/mistralaiuses
- npm @mistralai/mistralai-azureuses
- npm @mistralai/mistralai-gcpuses
- npm @ml-toolkit-ts/preprocessinguses
- npm @ml-toolkit-ts/xgboostuses
- npm @opensearch-project/opensearchuses
- npm @squawk/airport-datauses
- npm @squawk/airportsuses
- npm @squawk/airspaceuses
- npm @squawk/airspace-datauses
- npm @squawk/airway-datauses
- npm @squawk/airwaysuses
- npm @squawk/fix-datauses
- npm @squawk/fixesuses
- npm @squawk/flight-mathuses
- npm @squawk/flightplanuses
- npm @squawk/geouses
- npm @squawk/icao-registryuses
- npm @squawk/icao-registry-datauses
- npm @squawk/mcpuses
- npm @squawk/navaid-datauses
- npm @squawk/navaidsuses
- npm @squawk/notamsuses
- npm @squawk/procedure-datauses
- npm @squawk/proceduresuses
- npm @squawk/typesuses
- npm @squawk/unitsuses
- npm @squawk/weatheruses
- npm @supersurkhet/cliuses
- npm @supersurkhet/sdkuses
- npm @tallyui/componentsuses
- npm @tallyui/connector-medusauses
- npm @tallyui/connector-shopifyuses
- npm @tallyui/connector-vendureuses
- npm @tallyui/connector-woocommerceuses
- npm @tallyui/coreuses
- npm @tallyui/databaseuses
- npm @tallyui/posuses
- npm @tallyui/storage-sqliteuses
- npm @tallyui/themeuses
- npm @tanstack/arktype-adapteruses
- npm @tanstack/eslint-plugin-routeruses
- npm @tanstack/eslint-plugin-startuses
- npm @tanstack/historyuses
- npm @tanstack/nitro-v2-vite-pluginuses
- npm @tanstack/react-routeruses
- npm @tanstack/react-router-devtoolsuses
- npm @tanstack/react-router-ssr-queryuses
- npm @tanstack/react-startuses
- npm @tanstack/react-start-clientuses
- npm @tanstack/react-start-rscuses
- npm @tanstack/react-start-serveruses
- npm @tanstack/router-cliuses
- npm @tanstack/router-coreuses
- npm @tanstack/router-devtoolsuses
- npm @tanstack/router-devtools-coreuses
- npm @tanstack/router-generatoruses
- npm @tanstack/router-pluginuses
- npm @tanstack/router-ssr-query-coreuses
- npm @tanstack/router-utilsuses
- npm @tanstack/router-vite-pluginuses
- npm @tanstack/solid-routeruses
- npm @tanstack/solid-router-devtoolsuses
- npm @tanstack/solid-router-ssr-queryuses
- npm @tanstack/solid-startuses
- npm @tanstack/solid-start-clientuses
- npm @tanstack/solid-start-serveruses
- npm @tanstack/start-client-coreuses
- npm @tanstack/start-fn-stubsuses
- npm @tanstack/start-plugin-coreuses
- npm @tanstack/start-server-coreuses
- npm @tanstack/start-static-server-functionsuses
- npm @tanstack/start-storage-contextuses
- npm @tanstack/valibot-adapteruses
- npm @tanstack/virtual-file-routesuses
- npm @tanstack/vue-routeruses
- npm @tanstack/vue-router-devtoolsuses
- npm @tanstack/vue-router-ssr-queryuses
- npm @tanstack/vue-startuses
- npm @tanstack/vue-start-clientuses
- npm @tanstack/vue-start-serveruses
- npm @tanstack/zod-adapteruses
- npm @taskflow-corp/cliuses
- npm @tolka/cliuses
- npm @uipath/access-policy-sdkuses
- npm @uipath/access-policy-tooluses
- npm @uipath/admin-tooluses
- npm @uipath/agent-sdkuses
- npm @uipath/agent-tooluses
- npm @uipath/agent.sdkuses
- npm @uipath/aops-policy-tooluses
- npm @uipath/ap-chatuses
- npm @uipath/api-workflow-tooluses
- npm @uipath/apollo-coreuses
- npm @uipath/apollo-reactuses
- npm @uipath/apollo-winduses
- npm @uipath/authuses
- npm @uipath/case-tooluses
- npm @uipath/cliuses
- npm @uipath/codedagent-tooluses
- npm @uipath/codedagents-tooluses
- npm @uipath/codedapp-tooluses
- npm @uipath/commonuses
- npm @uipath/context-grounding-tooluses
- npm @uipath/data-fabric-tooluses
- npm @uipath/docsai-tooluses
- npm @uipath/filesystemuses
- npm @uipath/flow-tooluses
- npm @uipath/functions-tooluses
- npm @uipath/gov-tooluses
- npm @uipath/identity-tooluses
- npm @uipath/insights-sdkuses
- npm @uipath/insights-tooluses
- npm @uipath/integrationservice-sdkuses
- npm @uipath/integrationservice-tooluses
- npm @uipath/llmgw-tooluses
- npm @uipath/maestro-sdkuses
- npm @uipath/maestro-tooluses
- npm @uipath/orchestrator-tooluses
- npm @uipath/packager-tool-apiworkflowuses
- npm @uipath/packager-tool-bpmnuses
- npm @uipath/packager-tool-caseuses
- npm @uipath/packager-tool-connectoruses
- npm @uipath/packager-tool-flowuses
- npm @uipath/packager-tool-functionsuses
- npm @uipath/packager-tool-webappuses
- npm @uipath/packager-tool-workflowcompileruses
- npm @uipath/packager-tool-workflowcompiler-browseruses
- npm @uipath/platform-tooluses
- npm @uipath/project-packageruses
- npm @uipath/resource-tooluses
- npm @uipath/resourcecatalog-tooluses
- npm @uipath/resources-tooluses
- npm @uipath/robotuses
- npm @uipath/rpa-legacy-tooluses
- npm @uipath/rpa-tooluses
- npm @uipath/solution-packageruses
- npm @uipath/solution-tooluses
- npm @uipath/solutionpackager-sdkuses
- npm @uipath/solutionpackager-tool-coreuses
- npm @uipath/tasks-tooluses
- npm @uipath/telemetryuses
- npm @uipath/test-manager-tooluses
- npm @uipath/tool-workflowcompileruses
- npm @uipath/traces-tooluses
- npm @uipath/ui-widgets-multi-file-uploaduses
- npm @uipath/uipath-python-bridgeuses
- npm @uipath/vertical-solutions-tooluses
- npm @uipath/vssuses
- npm @uipath/widget.sdkuses
- npm agentwork-cliuses
- npm cmux-agent-mcpuses
- npm cross-stitchuses
- npm git-branch-selectoruses
- npm git-git-gituses
- npm ml-toolkit-tsuses
- npm nextmove-mcpuses
- npm safe-actionuses
- npm ts-dnauses
- npm wot-apiuses
- pypi guardrails-aiuses
- pypi mistralaiuses
- npm iceberg-javascriptuses
- npm supabase-javascriptuses
- npm auth-javascriptuses
- npm microsoft-applicationinsights-commonuses
- npm ms-graph-typesuses
- npm faster-axiosuses
- npm atomic-lockfileuses
Campaigns
- No Specific Campaignattributed-to
- Contagious Interviewattributed-to
- fucktestpad npm Malwareattributed-to
- shetty123 Telegram Hijackattributed-to
- tanvisoul9 npm Backdoorsattributed-to
- Mini Shai-Huludattributed-to
- Claude Code Hook Backdoorsattributed-to
- Epsilon Axios Typosquat Campaignattributed-to
- Atomic Archattributed-to
