Telecom
Attackers Exploit Stolen Session Cookies to Bypass Multi Factor Authentication and Gain Access to Corporate Resources – Sophos Report Reveals
Sophos, a global leader in next-generation cybersecurity, today announced in the Sophos X-Ops report, “Cookie stealing: the new perimeter bypass,” that active adversaries are increasingly exploiting stolen session cookies to bypass Multi-Factor Authentication (MFA) and gain access to corporate resources.
In some cases, the cookie theft itself is a highly targeted attack, with adversaries scraping cookie data from compromised systems within a network and using legitimate executable to disguise the malicious activity.
Once the attackers obtain access to corporate web-based and cloud resources using the cookies, they can use them for further exploitation such as business email compromise, social engineering to gain additional system access, and even modification of data or source code repositories.
“Over the past year, we’ve seen attackers increasingly turn to cookie theft to work around the growing adoption of MFA. Attackers are turning to new and improved versions of information stealing malware like Raccoon Stealer to simplify the process of obtaining authentication cookies, also known as access tokens,” said Sean Gallagher, principal threat researcher, Sophos. “If attackers have session cookies, they can move freely around a network, impersonating legitimate users.”
Session, or authentication, cookies are a particular type of cookie stored by a web browser when a user logs into web resources. If attackers obtain them, then they can conduct a “pass-the-cookie” attack whereby they inject the access token into a new web session, tricking the browser into believing it is the authenticated user and nullifying the need for authentication.
Since a token is also created and stored on a web browser when using MFA, this same attack can be used to bypass this additional layer of authentication.
Compounding the issue is that many legitimate web-based applications have long-lasting cookies that rarely or never expire; other cookies only expire if the user specifically logs out of the service.
Thanks to the malware-as-a-service industry, it’s getting easier for entry-level attackers to get involved in credential theft. For example, all they need to do is buy a copy of an information-stealing Trojan like Raccoon Stealer to collect data like passwords and cookies in bulk and then sell them on criminal marketplaces, including Genesis.
Other criminals on the attack chain, such as ransomware operators, can then buy this data and sift through it to leverage anything they deem useful for their attacks.
Conversely, in two of the recent incidents that Sophos investigated, attackers took a more targeted approach. In one case, the attackers spent months inside a target’s network gathering cookies from the Microsoft Edge browser.
The initial compromise occurred via an exploit kit, and then the attackers used a combination of Cobalt Strike and Meterpreter activity to abuse a legitimate compiler tool to scrape access tokens. In another case, the attackers used a legitimate Microsoft Visual Studio component to drop a malicious payload that scraped cookie files for a week.
“While historically we’ve seen bulk cookie theft, attackers are now taking a targeted and precise approach to cookie stealing. Because so much of the workplace has become web-based, there really is no end to the types of malicious activity attackers can carry out with stolen session cookies. They can tamper with cloud infrastructures, compromise business email, and convince other employees to download malware or even rewrite code for products. The only limitation is their own creativity,” said Gallagher.
“Complicating matters is that there is no easy fix. For example, services can shorten the lifespan of cookies, but that means users must re-authenticate more often, and, as attackers turn to legitimate applications to scrape cookies, companies need to combine malware detection with behavioral analysis.”
To learn more about session cookie theft and how adversaries are exploiting the technique to carry out malicious activity, read the full report, “Cookie Stealing: the new perimeter bypass,” on Sophos.com.
Lebara Nigeria has become a member of the Global System for Mobile Communications Association (GSMA) as it expands operations in the West African country.
The membership places Lebara Nigeria within a global network of more than 1,000 mobile operators, device manufacturers, technology companies and digital service providers.
Through the GSMA, the company will have access to industry research, technical standards, policy engagement and industry initiatives.
Lebara Nigeria said the move reflects its participation in the wider telecommunications ecosystem as it develops its operations in Nigeria’s mobile market.
Nigeria’s telecommunications sector plays a central role in the country’s digital economy, with more than 170 million active mobile subscriptions supporting services such as digital payments, e-commerce, education and healthcare.
Industry analysts say participation in international bodies such as the GSMA supports knowledge sharing and the adoption of industry standards.
Lebara Nigeria said GSMA membership will support its engagement with industry developments and policy discussions in the telecommunications sector.
The company said it remains focused on operating in Nigeria’s mobile telecommunications market as demand for connectivity continues to grow.
GSM Association is the advocacy and lobbying organization for the mobile communications industry, representing more than 1,000 mobile operators as full members and a further 400 companies in the broader mobile ecosystem as associate members.
Management of Vitel Wireless, mobile virtual network operator (MVNO), has distanced the company from a fraudulent scheme operating under the name: “Vitel Shares Services.”
In an official statement, the management clarified that Vitel Wireless is not selling shares or running any investment schemes.
They warned that the operators of “Vitel Shares Services” are using unauthorised websites, mobile applications, social media promotions, and bank accounts falsely linked to Vitel Wireless to mislead the public.
The statement reads: “The attention of Vitel Wireless has been drawn to a fraudulent scheme operating under the name ‘Vitel Shares Services.’
“We wish to state clearly that Vitel Wireless has no affiliation with Vitel Shares Services, or any platform claiming to offer Vitel shares, investments, or financial products through unofficial channels.
“We do not solicit investments through agents, social media, websites, apps, or third parties. Any platform claiming to offer Vitel Wireless shares or investments outside our official channels is fraudulent and should be treated as such.
“We urge the general public to remain vigilant and verify all information through official Vitel Wireless communication channels before making any payments or sharing personal data.”
Airtel Nigeria has concluded its second Customer Forum in Abuja, bringing together a large section of customers including high-volume data subscribers, 5G customers, and key stakeholders in another landmark engagement aimed at addressing concerns around data usage, transparency, and customer experience.
The forum themed “Understanding Your Data and Taking Control 2.0.” aimed to strengthen trust in Nigeria’s rapidly evolving telecommunications landscape. The session also featured inputs from representatives of the Nigerian Communications Commission (NCC).
Delivering the Keynote remarks, Dinesh Balsingh, CEO of Airtel Nigeria, who was represented by Femi Adeniran, Director, Corporate Communications and CSR, emphasised that trust remains the most valuable currency in telecommunications, and Airtel remains committed to strengthening customer confidence through transparency and continuous engagement.
He explained that discussions around data consumption have become increasingly important as digital lifestyles evolve, with smartphones, cloud services, video streaming and emerging artificial intelligence applications significantly influencing data usage patterns.
According to him, Airtel recently introduced the Airtel Data Calculator, an innovative tool designed to help customers estimate their data needs based on online activities such as multimedia streaming, video calls, social media usage, and gaming.
“The purpose of the Airtel Data Calculator is to provide greater visibility, support informed decision-making and place more information directly in the hands of customers. Because transparency should never be viewed as a compliance exercise. Transparency is good business,” he stated.
He further reassured customers that Airtel has no incentive to shortchange subscribers through inaccurate billing, forced spending or unnecessary data depletion, stressing that the company’s growth depends on customer satisfaction, loyalty and trust.
Adeniran also highlighted Airtel’s continued investments in network infrastructure, fibre capacity, digital platforms, artificial intelligence capabilities, customer service systems and workforce development, noting that these investments are aimed at improving service quality and enhancing customer experiences.
Oladokun Oye, Director, Customer Experience, Airtel Nigeria, while welcoming participants to the event, said the forum was created to provide customers with an open platform for education, engagement and problem-solving, noting that the customer remains at the centre of Airtel’s business.
“Data has become central to everyday life, powering work, education, commerce, entertainment, healthcare and countless opportunities. As data usage grows, so too does the desire for greater visibility and understanding.
Today’s conversation is part of an ongoing journey. A journey toward greater transparency. A journey toward deeper understanding. And a journey toward a better customer experience for every Airtel subscriber,” he said.
The forum also featured practical demonstrations on data consumption management, device settings, and usage habits that impact data usage. It also included an interactive session by which Airtel teams provided clarifications and offered feedback to customers.
The Abuja event follows the successful maiden edition held earlier this year in Lagos and aligns with broader industry efforts led by the Nigerian Communications Commission (NCC) to improve consumer awareness, transparency, and confidence within the telecommunications sector.
Lebara Nigeria Becomes Member of GSMA Network
FG to Abolish JSS-SSS Separation Policy after 20m Pupils Drop Out
Vitel Wireless Warns Public, Says it Not Running any Investment Scheme
Army Says Terrorists Now Recruiting, Raising Funds Online
FG Mulls National Skills Database to Tackle Unemployment
Mobile Internet Gender Gap Widest in Africa – GSMA
London Strengthens Global Investment Ties with Africa @ First Ever London-Africa Business Summit
FG Targets Alleged N3tn Capital Flight, Opens Airtime Credit Market to Nigerian Fintechs
Japan, UNESCO Boost Digital Learning in 15 CoEs with Donation of ICT Equipment
Good News for DStv Users: Watch over 160 Channels Without Paying Extra
E-Business2 days agoLG Showcases AI-Powered Smart Living Innovations @ Africa Technology Expo 2026
Telecom2 days agoOADC Reaffirms Abundant Capacity in Data Centres in Nigeria to Host Financial Data
E-Financial2 days agoUBA mobilises employees across Africa for environmental clean-up, wellness campaign
General News2 days agoLASTMA Launches 3367 Toll-Free Hotline for Emergency Response, Traffic Management
E-Financial2 days agoPalmPay Calls for Trust, Infrastructure and Responsible AI to Drive Payment Ecosystem Innovation
Telecom2 days agoALTON Backs NCC’s Local Smartphone Manufacturing Drive to Widen Digital Access
E-Business2 days agoWant a Business Loan Without Interest? SMEDAN Launches N500m Fund
E-Financial2 days agongCERT Raises Alarm over Surge in Banks’ ATM Cyberattacks