A proof-of-concept attack called "Cookie-Bite" uses a browser extension to steal browser session cookies from Azure Entra ID to bypass multi-factor authentication (MFA) protections and maintain access to cloud services like Microsoft 365, Outlook, and Teams. The Cookie-Bite attack consists of a malicious Chrome extension that acts as an infostealer, targeting the 'ESTAUTH' and 'ESTSAUTHPERSISTNT' cookies in Azure Entra ID, Microsoft's cloud-based identity and access management (IAM) service. It should be noted that while this extension was created to target Microsoft session cookies, it can be modified to target other services, including Google, Okta, and AWS cookies. If threat actors have access to the device, they can deploy a PowerShell script that runs via the Windows Task Scheduler to automate the re-injection of the unsigned extension at every launch of Chrome using developer mode. When a login occurs, it reads all cookies scoped to 'login.microsoftonline.com,' applies filtering to extract the two mentioned tokens, and exfiltrates the cookie JSON data to the attacker via a Google Form. From there, the attacker may use Graph Explorer to enumerate users, roles, and devices, send messages or access chats on Microsoft Teams, and read or download emails via Outlook Web.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 22 Apr 2025 15:05:04 +0000