CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Storm infostealer enables server-side decryption and automated session hijacking across browsers and applications

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A newly observed infostealer named Storm has been deployed in early 2026, providing cybercriminals with a subscription-based tool that exfiltrates browser credentials, session cookies, cryptocurrency wallet data, and application sessions while avoiding local decryption artifacts that endpoint security tools traditionally detect. Storm automatically restores authenticated sessions using stolen tokens via a central operator panel, enabling persistent access to SaaS platforms, cloud environments, and internal tools without triggering multi-factor authentication or password-based alerts. The malware targets Chromium and Gecko-based browsers, messaging apps, documents, and system artifacts, all processed server-side to evade detection. Operators deploy the tool via compromised or purchased infrastructure, managing multiple workers and builds under a unified control panel. At least 1,715 entries were observed in the operator panel, spanning multiple countries and services commonly associated with account takeover and initial access operations.

Timeline

  1. 13.04.2026 17:05 1 articles · 3h ago

    Storm infostealer enables server-side decryption and automated session hijacking across browsers and applications

    A new infostealer named Storm began circulating in early 2026, offering a subscription-based service that exfiltrates browser credentials, session cookies, and cryptocurrency wallet data to attacker-controlled servers for server-side decryption. The malware automates session restoration using stolen tokens, enabling silent hijacking of authenticated sessions on SaaS platforms, cloud environments, and internal tools without triggering MFA or password alerts. Storm targets Chromium and Gecko-based browsers, messaging apps (Telegram, Signal, Discord), cryptocurrency wallets, documents, and system information, while operating primarily in memory to evade detection. Operators manage multiple workers and builds through a unified panel, with builds maintaining data collection even after subscription expiration.

    Show sources
    Open in new tab

Information Snippets