Telecom
Attackers Exploit Stolen Session Cookies to Bypass Multi Factor Authentication and Gain Access to Corporate Resources – Sophos Report Reveals
Sophos, a global leader in next-generation cybersecurity, today announced in the Sophos X-Ops report, “Cookie stealing: the new perimeter bypass,” that active adversaries are increasingly exploiting stolen session cookies to bypass Multi-Factor Authentication (MFA) and gain access to corporate resources.
In some cases, the cookie theft itself is a highly targeted attack, with adversaries scraping cookie data from compromised systems within a network and using legitimate executable to disguise the malicious activity.
Once the attackers obtain access to corporate web-based and cloud resources using the cookies, they can use them for further exploitation such as business email compromise, social engineering to gain additional system access, and even modification of data or source code repositories.
“Over the past year, we’ve seen attackers increasingly turn to cookie theft to work around the growing adoption of MFA. Attackers are turning to new and improved versions of information stealing malware like Raccoon Stealer to simplify the process of obtaining authentication cookies, also known as access tokens,” said Sean Gallagher, principal threat researcher, Sophos. “If attackers have session cookies, they can move freely around a network, impersonating legitimate users.”
Session, or authentication, cookies are a particular type of cookie stored by a web browser when a user logs into web resources. If attackers obtain them, then they can conduct a “pass-the-cookie” attack whereby they inject the access token into a new web session, tricking the browser into believing it is the authenticated user and nullifying the need for authentication.
Since a token is also created and stored on a web browser when using MFA, this same attack can be used to bypass this additional layer of authentication.
Compounding the issue is that many legitimate web-based applications have long-lasting cookies that rarely or never expire; other cookies only expire if the user specifically logs out of the service.
Thanks to the malware-as-a-service industry, it’s getting easier for entry-level attackers to get involved in credential theft. For example, all they need to do is buy a copy of an information-stealing Trojan like Raccoon Stealer to collect data like passwords and cookies in bulk and then sell them on criminal marketplaces, including Genesis.
Other criminals on the attack chain, such as ransomware operators, can then buy this data and sift through it to leverage anything they deem useful for their attacks.
Conversely, in two of the recent incidents that Sophos investigated, attackers took a more targeted approach. In one case, the attackers spent months inside a target’s network gathering cookies from the Microsoft Edge browser.
The initial compromise occurred via an exploit kit, and then the attackers used a combination of Cobalt Strike and Meterpreter activity to abuse a legitimate compiler tool to scrape access tokens. In another case, the attackers used a legitimate Microsoft Visual Studio component to drop a malicious payload that scraped cookie files for a week.
“While historically we’ve seen bulk cookie theft, attackers are now taking a targeted and precise approach to cookie stealing. Because so much of the workplace has become web-based, there really is no end to the types of malicious activity attackers can carry out with stolen session cookies. They can tamper with cloud infrastructures, compromise business email, and convince other employees to download malware or even rewrite code for products. The only limitation is their own creativity,” said Gallagher.
“Complicating matters is that there is no easy fix. For example, services can shorten the lifespan of cookies, but that means users must re-authenticate more often, and, as attackers turn to legitimate applications to scrape cookies, companies need to combine malware detection with behavioral analysis.”
To learn more about session cookie theft and how adversaries are exploiting the technique to carry out malicious activity, read the full report, “Cookie Stealing: the new perimeter bypass,” on Sophos.com.
MTN Nigeria is set to reignite the dreams of creatives with the launch of its Best of the Streets talent competition for the 2025 edition. This initiative aims to discover and nurture Nigeria’s next generation of creative talent.
L-R: Mobolaji Ogunlende, Honourable Commissioner for Youth and Social Development, Lagos State; Dapo “D’Banj” Oyebanjo, Singer and Founder of C.R.E.A.M platform; Dandizzy, Rapper and Singer; A’isha Umar Mumuni, Chief Digital Officer, MTN Nigeria and Obi Asika, Nigerian music executive and Director-General, National Council for Arts and Culture, NCAC., at the Best of the Streets press briefing on Wednesday, April 23 held at the MTN Rooftop Events Centre, Ikoyi, Lagos.
Slated to commence on May 1, 2025, the competition offers unsigned artists a transformative platform to compete for life-changing rewards, including a grand money prize, professional music video production, and an EP recording deal.
At the press briefing on Wednesday April 23, A’isha Umar Mumuni, Chief Digital Officer of MTN Nigeria, emphasized the initiative’s impact.
“The premise of Best of the Streets is that there’s talent in every street in Nigeria, whether it’s acting, singing, dancing, comedy or other performance arts.
“Best of the Streets seeks to bring out that talent, to show Nigerian youths that there are opportunities everywhere; and at MTN, we are very proud to take part in creating these opportunities.”
Best of the Streets is in collaboration with C.R.E.A.M (Creative Reality Entertainment Art and Music), founded by Nigerian rapper, Dapo “D’Banj” Oyebanjo is a platform which provides talent management, publishing, and funding support to grassroots artists.
“The C.R.E.A.M platform provides solutions and services for talents, creatives and entrepreneurs, by granting them convenient access to showcase their skills and monetize their content. With our newly launched distribution arm, we are not just discovering talent, we are giving them the tools to take them global,” D’banj explained.
Chris Anokute, Nigerian-born LA-based American Executive, known for discovering global superstar Katy Perry, commended the efforts of this initiative in pushing local Nigerian music to the international stage. “Best of the Streets is the greatest artiste discovery platform I’ve seen come out of Africa.
“The music industry is, as of last year, a 30-billion-dollar industry. Afrobeats is the fastest growing genre in the entire world, over 1.1 million hours of music streamed out of Nigeria on Spotify this year alone.”
On the importance of empowering the creative capacities of the youth, Mobolaji Ogunlende, Honourable Commissioner for Youth and Social Development in Lagos State. “As a government, we have vowed not to leave anybody behind in Lagos state, irrespective of their background.
“There are about 30 million citizens in Lagos, and 60% of the youth. Not every youth will be able to go to school, but we still have the creatives, digital, fashion icons, among others. This platform is an avenue to encourage them.”
To participate, aspiring contestants can dial *463# on their MTN line, upload original content via the official @creamplatform, and mobilise votes from the public. Over 2584 creatives are set to be showcased and rewarded this year. Entries into this competition continue up until December, with daily, weekly and monthly winners, with a final winner who will secure the grand prize.
The Best of the Streets initiative reinforces MTN’s commitment to youth empowerment and creative innovation, aligning with Nigeria’s growing entertainment industry demands.
Meta has announced its intention to appeal the decision of the Competition and Consumer Protection Tribunal (CCPT), which upheld a $220 million fine imposed by the Federal Competition and Consumer Protection Commission (FCCPC) over its data practices.
The penalty follows a 38-month investigation conducted by the FCCPC, in collaboration with the Nigeria Data Protection Commission (NDPC), which ran from 2021 to December 2023.
The investigation found evidence of unauthorised data sharing, insufficient user consent mechanisms, and discriminatory practices that treated Nigerian consumers differently from those in other regions.
In July 2024, the FCCPC imposed the $220 million fine on Meta and WhatsApp, citing violations of Nigeria’s data protection and consumer rights laws. Additionally, the ruling mandated corrective actions to ensure that Meta’s business practices comply with Nigerian regulations.
In a decision delivered on Friday, April 25, the tribunal upheld the fine, reaffirming the FCCPC’s authority and investigative processes. The tribunal also ordered Meta to pay an additional $35,000 to cover the costs incurred during the investigation.
However, Meta expressed disagreement with the tribunal’s ruling, stating in a statement on Saturday, April 26, that it would urgently seek to appeal the decision and apply for a stay of execution.
“We are urgently applying to stay the order and appeal today’s decision to avoid any impact to users,” WhatsApp said.
The company also contested the tribunal’s findings, claiming that the ruling misrepresented how WhatsApp operates and contained inaccuracies regarding its data practices.
Competition and Consumer Protection Tribunal has upheld a $220 million fine imposed by the Federal Competition and Consumer Protection Commission (FCCPC) on Meta Platforms Inc. and WhatsApp LLC for data privacy violations in Nigeria.
The Tribunal also awarded $35,000 in investigative costs to the country’s Federal Competition and Consumer Protection Commission .
In a statement issued by the FCCPC, the Tribunal delivered its judgment in the appeal filed by Meta Platforms Incorporated (Facebook) and WhatsApp LLC against the Federal Competition and Consumer Protection Commission (FCCPC), affirming the Commission’s authority and ruling in favour of its actions on nearly all contested issues.
According to the statement by the FCCPC, “The Tribunal specifically determined that the Commission adhered to prevailing laws, fulfilled its mandate, and exercised its powers by the 1999 Constitution (as amended).
“It ruled that the multiple actions by WhatsApp and Meta, for which the Commission made findings of violations, were correctly identified, and that the Commission did not err in making those findings.”
The statement revealed that WhatsApp and Meta’s legal team was led by Professor Gbolahan Elias (SAN), while the FCCPC was represented by Babatunde Irukera.
It added that both legal teams presented their final arguments on behalf of their respective clients on January 28, 2025.
“The FCCPC had on July on July 19, 2024, issued a Final Order imposing a $220 million administrative penalty after concluding that the companies engaged in discriminatory and exploitative practices against Nigerian consumers, the investigation started in 2020.
“The case arose from a 38-month joint investigation initiated by the FCCPC and the Nigeria Data Protection Commission (NDPC) into the conduct, privacy practices, and consumer data policies of Meta Platforms and WhatsApp.
“Dissatisfied with the Order last year, Meta and WhatsApp appealed to the Tribunal, challenging both the legal basis and the findings of the Commission,” FCCPC said.
The Tribunal upheld the FCCPC’s authority and investigative procedures in Meta and WhatsApp’s appeal, resolving most of the contested issues in the Commission’s favour.
It confirmed that the FCCPC acted within its constitutional and statutory mandate, particularly regarding fair hearing, data protection, and consumer rights.
While it dismissed the majority of the appellants’ objections, it set aside one specific order (Order 7) for lacking sufficient legal basis.
While expressing satisfaction with the judgment, Tunji Bello, executive vice chairman/CEO, commended the Commission’s legal team for their exceptional diligence and forensic expertise in assembling evidence and presenting their case.
He reaffirmed the FCCPC’s unwavering commitment not only to protecting the rights of Nigerian consumers but also to promoting fair business practices in line with the FCCPA (2018) and the Renewed Hope Agenda of the Nigerian government.
AFC Appoints Ireti Samuel-Ogbu as Chair of Board of Directors
FG to Sanction Airports Without Permits from January 2026
CBN Urges Banks to Source FX for PAPSS Settlement Through NFEM
FIRS Orders Banks to Close Unauthorised Tax Collection Accounts
NBC Loses Appeal as Tribunal Upholds ₦190m Fine for Misleading Packaging
Telecom1 day agoMeta Challenges Nigerian Tribunal’s $220M Fine over Data Breaches
Broadcasting1 day agoAI and Cybersecurity: Balancing Innovation with Caution
E-Financial1 day agoSupreme Court Sets Aside N22 Trillion Judgement against Union Bank
E-Business1 day agoFG Warns Nigerians Against Growing Threat of Cyber Slavery in West Africa
News1 day agoEFCC Bans Cash above $10,000 from Leaving Nigeria without Declaration
E-Financial1 day agoUBA Envisions Footprint in over 100 Countries
E-Business1 day agoNCC Vows to Tackle Online Infringement, Block Illegal Music Websites
General News1 day agoAfe Babalola University Partners with New Horizons to Integrate 4IR Skills into Academic Curriculum