Cookie-Bite Chaos: The Hilarious Hijacking of Microsoft 365 via Cookie Theft!
The Cookie-Bite attack, a proof-of-concept by Varonis, uses a malicious Chrome extension to swipe session cookies from Azure Entra ID. This sneaky move bypasses MFA, granting attackers access to cloud services like Microsoft 365. It’s a reminder that when it comes to cybersecurity, trusting cookies can leave you with more than just crumbs.
Hot Take:
Is it a cyber attack or a cookie recipe gone wrong? Meet Cookie-Bite, the deliciously devious way to crumb-le your MFA defenses and make security teams cry over spilled milk (and stolen cookies)!
Key Points:
- Cookie-Bite attack uses a Chrome extension to steal Azure session cookies.
- Gets past MFA by replicating valid session tokens.
- Targets ‘ESTAUTH’ and ‘ESTSAUTHPERSISTENT’ tokens.
- Potentially modifiable for other services like Google and AWS.
- Not detectable by security vendors yet, making it a stealthy threat.
Already a member? Log in here