Storm Infostealer Decrypts Browser Data Server-Side to Hijack Sessions
Summary
Varonis describes Storm, a subscription infostealer that sends encrypted Chromium and Gecko browser data to operators for server-side decryption, then automates cookie-based session restoration. Its panel showed 1,715 logs, though real-victim status was uncertain.
Key points
- Storm collects browser passwords, session cookies, Google account tokens, autofill and payment data, files, messaging-app data, crypto wallets, system information, and screenshots.
- It sends encrypted browser data to operator-controlled servers for decryption, supporting Chromium and Gecko-based browsers.
- The operator panel can restore sessions using Google refresh tokens and geographically matched SOCKS5 proxies, according to the article.
- Operators can route stolen data through their own VPS nodes and use team-management features to distribute tasks.
- Varonis reported 1,715 log entries across multiple countries, but said panel imagery alone could not establish whether all entries represented real victims rather than test data.
- The article lists subscription prices of $900 per month for standard access and $1,800 per month for a team license; builds reportedly continue running after subscriptions expire.
Article Details
- Attack Vectors
- Storm collects saved browser passwords, session cookies, Google account tokens, autofill data, credit card data, browsing history, crypto-wallet data, and user files; it sends encrypted browser databases to operator-controlled servers for decryption.
- The operator panel automates session restoration using stolen cookies and a Google Refresh Token, with a geographically matched SOCKS5 proxy, enabling access to authenticated accounts without a password-based login.
- Storm collects session data from Telegram, Signal, and Discord, targets crypto wallets through browser extensions and desktop apps, and captures system information and screenshots.
- Operators connect their own VPS nodes to Storm’s central servers to route stolen data through infrastructure they control.
- Defensive Notes
- The article says server-side decryption avoids local browser-database access telemetry that endpoint tools commonly use to detect credential theft.
- The article identifies logins from unfamiliar locations, lateral movement, and data access that breaks established patterns as signs to watch for after session theft.
MITRE ATT&CK
T1005 · Data from Local SystemStorm collects documents from user directories as well as browser and other local data.T1041 · Exfiltration Over C2 ChannelStorm sends collected data to operator-controlled servers, with operators routing it through their own VPS nodes.T1113 · Screen CaptureStorm captures screenshots across multiple monitors.T1528 · Steal Application Access TokenThe article says Storm collects Google account tokens and that operators can use a Google Refresh Token during session restoration.T1539 · Steal Web Session CookieStorm collects browser session cookies for subsequent session restoration and hijacking.T1550.004 · Web Session CookieThe operator panel restores victims’ authenticated sessions using stolen cookies.T1555.003 · Credentials from Web BrowsersStorm harvests saved passwords from Chromium- and Gecko-based browsers.
Malware
StealC v2Storm takes this approach further by handling both Chromium and Gecko-based browsers (Firefox, Waterfox, Pale Moon) server-side, where StealC V2 still processes Firefox locally.StormStorm is a subscription-based infostealer that emerged in early 2026, harvesting browser credentials, session cookies, crypto wallets, files, and other sensitive data for remote decryption and automated exploitation.
Vendors
Products
DiscordBeyond credentials, Storm grabs documents from user directories, pulls session data from Telegram, Signal, and Discord, and targets crypto wallets through both browser extensions and desktop apps.Google ChromeThen Google introduced App-Bound Encryption in Chrome 127 (July 2024), which tied encryption keys to Chrome itself and made local decryption even harder.Microsoft 365 Apps for EnterpriseOur Cookie-Bite research demonstrated how stolen Azure Entra ID session cookies render MFA irrelevant, giving attackers persistent access to Microsoft 365 without ever needing a password.Mozilla FirefoxStorm takes this approach further by handling both Chromium and Gecko-based browsers (Firefox, Waterfox, Pale Moon) server-side, where StealC V2 still processes Firefox locally.Pale MoonStorm takes this approach further by handling both Chromium and Gecko-based browsers (Firefox, Waterfox, Pale Moon) server-side, where StealC V2 still processes Firefox locally.SignalBeyond credentials, Storm grabs documents from user directories, pulls session data from Telegram, Signal, and Discord, and targets crypto wallets through both browser extensions and desktop apps.TelegramBeyond credentials, Storm grabs documents from user directories, pulls session data from Telegram, Signal, and Discord, and targets crypto wallets through both browser extensions and desktop apps.WaterfoxStorm takes this approach further by handling both Chromium and Gecko-based browsers (Firefox, Waterfox, Pale Moon) server-side, where StealC V2 still processes Firefox locally.