-
NPM package caught using QR Code to fetch cookie-stealing malware
Newly discovered npm package 'fezbox' employs QR codes to hide a second-stage payload to steal cookies from a user's web browser. The package, masquerading as a utility library, leverages this innovative steganographic technique to harvest sensitive data, such as user credentials, from a compromised machine.
- September 23, 2025
- 06:42 AM
0
-
Brave's Cookiecrumbler tool taps community to help block cookie notices
Brave has open-sourceed a new tool called "Cookiecrumbler," which uses large language models (LLMs) to detect cookie consent notices and then community-driven reviews to block those that won't break site functionality.
- April 27, 2025
- 10:12 AM
0
-
New Webinar: Choose Your Own Investigation — Browser Attack Edition
Modern attacks have shifted focus to the browser, yet detection tools remain largely blind to the crucial activity happening there.
Join Push Security on February 11th for an interactive "choose-your-own-adventure" webinar on ClickFix, credential phishing, and other in-browser attacks we've observed in the wild.
-
Cookie-Bite attack PoC uses Chrome extension to steal session tokens
A proof-of-concept attack called "Cookie-Bite" uses a browser extension to steal browser session cookies from Azure Entra ID to bypass multi-factor authentication (MFA) protections and maintain access to cloud services like Microsoft 365, Outlook, and Teams.
- April 22, 2025
- 11:02 AM
- 0
-
Google Chrome reduced cookie requests to improve performance
Google shared details on a recently introduced Chrome feature that changes how cookies are requested, with early tests showing increased performance across all platforms.
- June 05, 2024
- 06:20 PM
- 0
-
New Chrome feature aims to stop hackers from using stolen cookies
Google announced a new Chrome security feature called 'Device Bound Session Credentials' that ties cookies to a specific device, blocking hackers from stealing and using them to hijack users' accounts.
- April 02, 2024
- 02:08 PM
- 7
-
PayPal files patent for new method to detect stolen cookies
PayPal has filed a patent application for a novel method that can identify when "super-cookie" is stolen, which could improve the cookie-based authentication mechanism and limit account takeover attacks.
- February 25, 2024
- 11:02 AM
- 3
-
Malware abuses Google OAuth endpoint to ‘revive’ cookies, hijack accounts
Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset.
- December 29, 2023
- 11:13 AM
- 5
-
Thousands of Apache Superset servers exposed to RCE attacks
Apache Superset is vulnerable to authentication bypass and remote code execution at default configurations, allowing attackers to potentially access and modify data, harvest credentials, and execute commands.
- April 26, 2023
- 11:52 AM
- 0
-
CircleCI's hack caused by malware stealing engineer's 2FA-backed session
Hackers breached CircleCi in December after an engineer became infected with information-stealing malware that stole the employee's 2FA-backed SSO session, allowing access to the company's internal systems.
- January 14, 2023
- 05:28 PM
- 0
-
GitHub's new privacy policy sparks backlash over tracking cookies
Developers are furious at GitHub's upcoming privacy policy changes that would allow GitHub to place tracking cookies on some of its subdomains. The Microsoft subsidiary announced this month, it would be adding "non-essential cookies" on some marketing web pages starting in September, and offered a 30-day "comment period."
- August 11, 2022
- 03:45 AM
- 3
-
Clever phishing method bypasses MFA using Microsoft WebView2 apps
A clever, new phishing technique uses Microsoft Edge WebView2 applications to steal victim's authentication cookies, allowing threat actors to bypass multi-factor authentication when logging into stolen accounts.
- June 26, 2022
- 10:12 AM
- 5
-
Firefox now blocks cross-site tracking by default for all users
Mozilla says that starting today, all Firefox users will now be protected by default against cross-site tracking while browsing the Internet.
- June 14, 2022
- 11:04 AM
- 1
-
Firefox Focus now blocks cross-site tracking on Android devices
Mozilla's Firefox Focus web browser can now protect Android users against cross-site tracking while browsing the Internet by preventing cookies from being used for advertising and monitoring your activity.
- January 11, 2022
- 03:42 PM
- 0
-
Google: YouTubers’ accounts hijacked with cookie-stealing malware
Google says YouTube creators have been targeted with password-stealing malware in phishing attacks coordinated by financially motivated threat actors since at least late 2019.
- October 20, 2021
- 11:49 AM
- 0
-
Firefox adds enhanced cookie clearing, HTTPS by default in private browsing
Mozilla says that, starting in Firefox 91 released today, users will be able to fully erase the browser history for all visited websites which prevents privacy violations due to "sneaky third-party cookies sticking around."
- August 10, 2021
- 09:54 AM
- 2
-
FlyTrap malware hijacks thousands of Facebook accounts
A new Android threat that researchers call FlyTrap has been hijacking Facebook accounts of users in more than 140 countries by stealing session cookies.
- August 09, 2021
- 05:43 PM
- 3
-
DuckDuckGo's new email privacy service forwards tracker-free messages
DuckDuckGo is rolling out an email privacy feature that strips incoming messages of trackers that can help profile you for better profiling and ad targeting.
- July 20, 2021
- 03:03 PM
- 2
-
Firefox now blocks cross-site tracking by default in private browsing
Mozilla says that Firefox users will be protected against cross-site tracking automatically while browsing the Internet in Private Browsing mode.
- June 01, 2021
- 11:00 AM
- 0
-
GitHub disables Google FLoC user tracking on its website
GitHub has announced rolling out a mysterious HTTP header on all GitHub Pages sites to block Google FLoC tracking.
- April 28, 2021
- 01:25 AM
- 4
-
Vivaldi, Brave, DuckDuckGo reject Google's FLoC ad tracking tech
Makers of Vivaldi and Brave web browsers have rejected Google's new privacy-preserving proposal called FLoC, which is meant to replace third-party tracking cookies across websites on browsers, including Chrome.
- April 14, 2021
- 11:59 AM
- 2
- 1
- 2
