Telecom
Attackers Exploit Stolen Session Cookies to Bypass Multi Factor Authentication and Gain Access to Corporate Resources – Sophos Report Reveals
Sophos, a global leader in next-generation cybersecurity, today announced in the Sophos X-Ops report, “Cookie stealing: the new perimeter bypass,” that active adversaries are increasingly exploiting stolen session cookies to bypass Multi-Factor Authentication (MFA) and gain access to corporate resources.
In some cases, the cookie theft itself is a highly targeted attack, with adversaries scraping cookie data from compromised systems within a network and using legitimate executable to disguise the malicious activity.
Once the attackers obtain access to corporate web-based and cloud resources using the cookies, they can use them for further exploitation such as business email compromise, social engineering to gain additional system access, and even modification of data or source code repositories.
“Over the past year, we’ve seen attackers increasingly turn to cookie theft to work around the growing adoption of MFA. Attackers are turning to new and improved versions of information stealing malware like Raccoon Stealer to simplify the process of obtaining authentication cookies, also known as access tokens,” said Sean Gallagher, principal threat researcher, Sophos. “If attackers have session cookies, they can move freely around a network, impersonating legitimate users.”
Session, or authentication, cookies are a particular type of cookie stored by a web browser when a user logs into web resources. If attackers obtain them, then they can conduct a “pass-the-cookie” attack whereby they inject the access token into a new web session, tricking the browser into believing it is the authenticated user and nullifying the need for authentication.
Since a token is also created and stored on a web browser when using MFA, this same attack can be used to bypass this additional layer of authentication.
Compounding the issue is that many legitimate web-based applications have long-lasting cookies that rarely or never expire; other cookies only expire if the user specifically logs out of the service.
Thanks to the malware-as-a-service industry, it’s getting easier for entry-level attackers to get involved in credential theft. For example, all they need to do is buy a copy of an information-stealing Trojan like Raccoon Stealer to collect data like passwords and cookies in bulk and then sell them on criminal marketplaces, including Genesis.
Other criminals on the attack chain, such as ransomware operators, can then buy this data and sift through it to leverage anything they deem useful for their attacks.
Conversely, in two of the recent incidents that Sophos investigated, attackers took a more targeted approach. In one case, the attackers spent months inside a target’s network gathering cookies from the Microsoft Edge browser.
The initial compromise occurred via an exploit kit, and then the attackers used a combination of Cobalt Strike and Meterpreter activity to abuse a legitimate compiler tool to scrape access tokens. In another case, the attackers used a legitimate Microsoft Visual Studio component to drop a malicious payload that scraped cookie files for a week.
“While historically we’ve seen bulk cookie theft, attackers are now taking a targeted and precise approach to cookie stealing. Because so much of the workplace has become web-based, there really is no end to the types of malicious activity attackers can carry out with stolen session cookies. They can tamper with cloud infrastructures, compromise business email, and convince other employees to download malware or even rewrite code for products. The only limitation is their own creativity,” said Gallagher.
“Complicating matters is that there is no easy fix. For example, services can shorten the lifespan of cookies, but that means users must re-authenticate more often, and, as attackers turn to legitimate applications to scrape cookies, companies need to combine malware detection with behavioral analysis.”
To learn more about session cookie theft and how adversaries are exploiting the technique to carry out malicious activity, read the full report, “Cookie Stealing: the new perimeter bypass,” on Sophos.com.
Airtel Nigeria has reaffirmed its long-term commitment to strengthening Nigeria’s digital infrastructure and data access to bridge gaps in connectivity and unlock new opportunities in the country.
The company restated this commitment during a recent high-level inspection tour of the Nxtra Data Centre that is being developed through Nxtra by Airtel Africa at Eko Atlantic, Lagos, the highly rated smart city with ambition to become the Data Centre hub of Nigeria.
The inspection tour was led by the Chief Executive Officer of Airtel Nigeria, Dinesh Balsingh and the Chief Executive Officer of Nxtra by Airtel Africa, Yashnath Issur, with the esteemed chairman of Eko Atlantic Mr. Gabbi Massoud, the CEO of the lead Engineering firm Design Group Limited, Mr. Bayo Odunlami and tech journalists.
The Nxtra Data Centre went through a stringent design validation process and cleared the approval to proceed construction from Eko Atlantic.
Commenting on the developments, Mr Issur said the site visit was a milestone marker and an indication of the company’s commitment to delivering the world-class digital facility on time and ensure that, ultimately, the investments deliver reliable, secure, world-class services for Nigeria and the rest of the continent.
“This Nxtra Data Centre in Lagos represents a critical part of our long-term vision for Nigeria’s digital ecosystem. Today’s visit allows us to review progress, engage our stakeholders, and ensure that our infrastructure investments continue to meet global standards and local needs.
“This data centre will deliver critical high multi megawatt capacity in line with hyperscale customers and enable high density environment. We are putting the infra to bring the cloud to Nigeria,” he said.
The data centre, set to be the largest in Nigeria, is being established to deliver hyperscale and edge facilities across key African markets. With a load of 38 Megawatts, the Lagos facility is expected to serve as a major hub for data hosting, cloud services, content distribution, artificial intelligence, and enterprise solutions in West Africa.
In his remarks, Mr Balsingh reiterated that the data centre was progressing steadily towards the previously announced 2028 go live date.
“Since the announcement of this project, our focus has been on building a world-class facility that supports Africa’s digital transformation agenda. We are encouraged by the progress recorded so far and remain committed to delivering a secure, energy-efficient, and future-ready data centre for Nigeria,” he said.
During the tour, stakeholders were ushered through key sections of the site, including piling zones, where required structural requirements have been tested. Technical teams provided briefings on infrastructure design, security architecture, redundancy systems, and sustainability measures being implemented to ensure reliability and operational excellence.
Strategically located close to major fibre routes and undersea cable landing stations, the Eko Atlantic data centre is designed to enhance Nigeria’s data sovereignty, reduce latency, and improve access to reliable digital services for private and enterprise customers, significantly boosting the country’s data hosting capacity and supporting emerging technologies such as artificial intelligence and cloud computing.
Mr. Massoud noted that the inspection tour underscored the city’s dedication to infrastructure of global relevance.
“Eko Atlantic as a city with high quality infrastructure will contribute positively to boost the economy of Nigeria and is a perfect place for the development of the digital infrastructure of Nigeria. The Nxtra data centre reflects the calibre of projects we seek to attract — long-term, technology-driven investments built to the highest global standards.
Today’s visit affirms the rigour of the planning and execution process by Nxtra, and the commitment of Eko Atlantic to facilitate and promote the Nigeria’s evolving digital ecosystem,” he said.
Through this ongoing investment, Airtel Nigeria and Nxtra continue to demonstrate their commitment to building infrastructure that enables innovation, supports economic development, and accelerates Nigeria’s digital transformation.
Nxtra by Airtel is developing a network of hyperscale data centres across the continent. Besides Lagos, construction of a new data centre has also commenced in Nairobi, Kenya and the Democratic Republic of Congo.
Google has partnered with top African research institutions to unveil WAXAL, a massive open-access speech dataset aimed at giving over 100 million people across Sub-Saharan Africa a stronger voice in the AI future.
The initiative, announced Monday, targets a key digital gap by supplying high-quality data for 21 local languages, such as Hausa, Yoruba, Luganda, and Acholi. It includes 1,250 hours of transcribed natural speech and more than 20 hours of studio-grade recordings for advanced synthetic voice tech.
Voice AI has exploded globally, yet Africa’s 2,000-plus languages suffer from severe data shortages, sidelining hundreds of millions from native-tongue tech access. WAXAL, three years in the making with Google funding, changes that equation.
“This dataset lays the groundwork for students, researchers, and entrepreneurs to craft tech in their own languages, impacting over 100 million lives,” said Aisha Walcott-Bryantt, Head of Google Research Africa.
She highlighted its potential for African innovators to develop educational tools and voice services that spark economic growth continent-wide.
Community-led from the start, the project involved Makerere University (Uganda), University of Ghana, Digital Umuganda (Rwanda), and others. These partners own the data outright, pioneering fair AI collaboration models.
Covered languages: Acholi, Akan, Dagaare, Dagbani, Dholuo, Ewe, Fante, Fulani (Fula), Hausa, Igbo, Ikposo (Kposo), Kikuyu, Lingala, Luganda, Malagasy, Masaaba, Nyankole, Rukiga, Shona, Soga (Lusoga), Swahili, Yoruba.
WAXAL goes live today. Details at goo.gle/IntroducingWaxal.
Nigerian Communications Commission (NCC) has unveiled its Q4 2025 Network Performance Reports, showcasing nationwide quality boosts fueled by over $1 billion in industry investments and sharper regulatory focus.
NCC
Speaking at the launch, Dr. Aminu Maida, executive vice chairman, NCC, hailed the Ookla-backed data as proof of NCC’s drive for transparent, evidence-driven oversight of Nigeria’s digital growth.
The reports track real-user experiences across cities, villages, highways, and nascent 5G areas, revealing faster median download speeds in both urban and rural spots versus Q3 2025.
Video streaming quality gaps between city and countryside have shrunk, thanks to a beefed-up 4G network—yet 5G rollout lags, upload speeds falter, and coverage holes linger in spots.
Maida said NCC is leaning on operators to fix these via spectrum tweaks, infrastructure drives, and stricter service rules, with 2025’s 2,850 new sites already paying off in broader reach and capacity.
Operators pledge even bigger spends in 2026 to keep the momentum, aiming for top-tier connectivity and economic inclusion for all Nigerians.
“We’ll turn these insights into real gains in service and access,” Maida affirmed, calling for sustained industry teamwork.
Accidental Billionaire Opts for Jail Instead of Returning Money Credited Him by Mistake
US Set to Deport 79 Nigerians on Criminal List
SEC Warns of Potential Ponzi-style Risks in AURUM BOT, ModMount
Airtel Nigeria Commits to Boosting Nigeria’s Digital Infrastructure
Ungoverned AI is Quietly Scaling Risk in Nigeria – Dr. Naiho
19 Nigerian Banks Meet CBN Recapitalization Targets Ahead of March Deadline
Youth Talent Takes Center Stage as T2 Ignites High-Octane Rap Battles @ Carnival Calabar
Aig-Imoukhuede Foundation Wrapped Up 2025 with Real Change in Governance, Health, Media Across Africa
Showmax Unlocks Easier Payments for Nigerian Subscribers via Baxi
Nigerian Terra Industries Secures $11.8m for Expansion
Telecom2 days agoTelecom Operators Invest Over $1Bn on 2,850 New Sites in 2025 – NCC
E-Financial2 days agoIf Capital is the Answer, What Exactly is the Problem with First Holdco
E-Financial2 days agoAmaanah Finance to Unveils Non-Interest Banking Services Today
General News2 days agoFirst Trustees to Host 8th Islamic Estate Planning Clinic in Abuja
News2 days agoNSCDC Hands over Fake Crypto Currency Trader to EFCC
News2 days agoAlakija’s Flourish Africa Provides N300m Grants for Women Entrepreneurs
General News2 days agoSecurity Forces Probe Use of Drones by Terrorists
Broadcasting2 days agoNew Horizons Nigeria Breaks Ground: First to Fuse Mandarin into ICT Curriculum