Full Report
New "Storm" infostealer skips local decryption, sending browser data to attacker servers. Varonis shows how server-side decryption enables session hijacking, bypassing passwords and MFA. [...]
Analysis Summary
# Tool/Technique: Storm Infostealer
## Overview
Storm is a sophisticated Information Stealer (Infostealer) that emerged in early 2026. It is offered as a Malware-as-a-Service (MaaS) for approximately $1,000 per month. Its primary innovation is the complete abandonment of local decryption of browser data on the victim's machine. By exfiltrating raw, encrypted database files to an attacker-controlled server for decryption, it bypasses modern endpoint security detections and Google’s "App-Bound Encryption" (introduced in Chrome 127).
## Technical Details
- **Type:** Malware Family (Infostealer / MaaS)
- **Platform:** Windows (Targeting Chromium and Gecko-based browsers)
- **Capabilities:** Credential harvesting, session hijacking, crypto-wallet theft, file exfiltration, and automated cookie restoration.
- **First Seen:** Early 2026
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1555.003 - Credentials from Web Browsers]
- [T1539 - Steal Web Session Cookie]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
- **[TA0007 - Discovery]**
- [T1083 - File and Directory Discovery]
- [T1125 - Video Capture (Screenshots)]
- **[TA0005 - Defense Evasion]**
- [T1027.003 - Steganography/In-Memory Execution]
- [T1622 - Debugger Evasion (Implied by bypassing App-Bound Encryption telemetry)]
## Functionality
### Core Capabilities
- **Server-Side Decryption:** Unlike traditional stealers (like StealC), Storm does not perform local SQLite queries or decryption. It ships encrypted browser files to its C2 infrastructure to avoid triggering endpoint telemetry.
- **Broad Browser Support:** Targets both Chromium-based browsers (Chrome, Edge) and Gecko-based browsers (Firefox, Waterfox, Pale Moon).
- **Session Hijacking:** Harvests session cookies and Google Refresh Tokens to bypass Multi-Factor Authentication (MFA).
- **Data Harvesting:** Collects saved passwords, autofill data, credit card information, and browsing history.
- **Crypto-Wallet Targeting:** Attacks both browser extension wallets and standalone desktop cryptocurrency applications.
### Advanced Features
- **Automated Cookie Restorer:** The management panel includes a feature to feed in stolen tokens and SOCKS5 proxies to automatically recreate an authenticated session.
- **Multi-Monitor Screenshots:** Captures visual data across all connected displays.
- **Distributed Infrastructure:** Uses a tiered VPS model where operators use their own nodes to route data, insulating the central "Storm" servers from takedowns.
- **Team Management:** Supports granular permissions for multiple "workers" within a single subscription.
## Indicators of Compromise
- **File Hashes:** *(Specific hashes not provided in the article; typically varies due to MaaS packing)*
- **File Names:** Look for unusual access to:
- `Login Data`
- `Cookies`
- `Web Data` (within AppData/Local/Google/Chrome/User Data/Default)
- **Network Indicators:**
- Connections to operator-controlled VPS nodes (Various IPs).
- Outbound exfiltration of SQLite database files.
- **Behavioral Indicators:**
- Rapid file reads of browser profile directories without associated local decryption API calls.
- Unexpected in-memory execution patterns (running without touching disk).
- Use of SOCKS5 proxies for authenticated session attempts.
## Associated Threat Actors
- Distributed as a subscription-based tool; used by various mid-to-high level cybercriminal affiliates. No specific named APT group is currently cited in the source.
## Detection Methods
- **Behavioral Detection:** Monitor for processes reading browser "Login Data" or "Cookies" files that do not originate from the browser's own process tree, followed by high-volume network exfiltration.
- **Network Traffic Analysis:** Identify large outbound transfers to unknown or low-reputation VPS providers (hosting the decryption nodes).
- **Identity Analytics:** Detect anomalous logins via stolen session tokens (e.g., "impossible travel" or logins from known SOCKS5 proxy exit nodes).
## Mitigation Strategies
- **Endpoint Protection:** Use EDR solutions that monitor file access events to sensitive browser directories.
- **Conditional Access:** Implement strict Conditional Access policies (e.g., Microsoft Entra ID) that require compliant/managed devices, not just MFA, to prevent stolen session reuse.
- **Token Hardening:** Shift toward phishing-resistant MFA (FIDO2/WebAuthn) which is less susceptible to simple session cookie replay.
- **Browser Security:** Encourage the use of features that tie sessions to hardware/device identity where applicable.
## Related Tools/Techniques
- **StealC V2:** A competing infostealer (mentions processing Firefox locally).
- **Cookie-Bite / SessionShark:** Related research and techniques regarding Azure/Entra ID session hijacking.
- **App-Bound Encryption:** The security feature in Chrome 127 that this malware specifically aims to bypass using server-side decryption.