{"id":12359,"date":"2024-11-01T06:51:53","date_gmt":"2024-11-01T13:51:53","guid":{"rendered":"https:\/\/legacy.gosecure.ai\/?p=12359"},"modified":"2024-11-12T10:11:25","modified_gmt":"2024-11-12T18:11:25","slug":"threat-hunt-of-the-month-sophisticated-phishing-campaigns-leveraging-web-session-cookie-theft","status":"publish","type":"post","link":"https:\/\/legacy.gosecure.ai\/fr\/blog\/2024\/11\/01\/threat-hunt-of-the-month-sophisticated-phishing-campaigns-leveraging-web-session-cookie-theft\/","title":{"rendered":"Threat Hunt of the Month: Sophisticated Phishing Campaigns Leveraging Web Session Cookie Theft"},"content":{"rendered":"

\"October<\/p>\n

 <\/p>\n

In October 2024, GoSecure Threat Hunters have uncovered a sophisticated phishing campaign that utilizes tactics like Attacker-in-the-Middle (AitM) and phishing to compromise user accounts through web session cookie theft. This specific method targets cloud-based file hosting applications such as Dropbox and OneDrive, compromising users by manipulating shared files and redirecting them to malicious sites where both credentials and multi-factor authentication details are stolen.<\/p>\n

Why This Matters <\/strong><\/p>\n

The theft of web session cookies is a critical threat as it allows attackers to bypass traditional security measures and gain access to sensitive information undetected. These cookies often authenticate personal and financial details, making their theft particularly dangerous. This technique is increasingly used in targeted phishing attacks, making awareness and prevention essential.<\/p>\n

Detection and Monitoring <\/strong><\/p>\n

GoSecure\u2019s proactive threat hunt in October identified and intercepted phishing attempts using legitimate-looking documents, such as a DocuSign envelope, as a lure to direct victims to malicious sites. Our Threat Hunters have been vigilant in monitoring for signs of this behavior and have established new detection rules that can identify similar threats in real-time.<\/p>\n

Recommendations <\/strong><\/p>\n

To defend against this type of attack, GoSecure recommends the following steps:<\/p>\n