# Vercel deploys Device Bound Session Credentials (DBSC) against infostealer session cookie theft

> Vercel is rolling out Device Bound Session Credentials (DBSC), binding login sessions to a TPM-held private key so session cookies stolen by infostealer malware cannot be replayed from another device. Support is Chrome on macOS and Windows (gradual rollout), and Vercel also deployed DPoP for the Vercel CLI.

- **Published:** 2026-11-04T21:48:23Z
- **Last reviewed:** 2026-11-04T21:48:23Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5272
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5272.png
- **ID:** TL-2026-5272
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 13

## Description

Vercel announced (reported by BleepingComputer on 2026-11-04) that it is deploying Device Bound Session Credentials (DBSC) for dashboard logins. At login, Chrome generates a key pair and stores the private key in secure hardware (TPM where available). The session then moves to short-lived cookies that must be periodically renewed by signing a server challenge with the device-bound key; the login response carries a Secure-Session-Registration header that points Chrome at the registration endpoint. A cookie exfiltrated by an infostealer expires within minutes and cannot be refreshed from a different machine. Vercel CTO Malte Ubl said the private key can never be retrieved again, not by Vercel, the user, or malware. Rollout is gradual to address OAuth edge cases and covers Chrome on macOS and Windows. Vercel is also deploying DPoP (Demonstration of Proof-of-Possession) for the Vercel CLI to protect OAuth tokens, a complementary control to DBSC for browser cookies.

The control targets a well-documented attack pattern. Chrome's App-Bound Encryption (introduced in Chrome 127, July 2024) was bypassed by multiple stealer families (Lumma, Vidar, Meduza, Lumar, WhiteSnake, StealC), some by reading cookies from Chromium process memory using ChromeKatz-style techniques and others (Exela Stealer) by manipulating registry policy to disable ABE. Stolen session cookies allow account takeover that bypasses passwords and MFA (MITRE T1539 / T1550.004). Chrome 146 introduced DBSC as the follow-on protection.

Context: Vercel disclosed a security incident on 2026-04-19/20 that began with compromise of the third-party AI tool Context.ai, whose Google Workspace OAuth app was compromised; the attacker took over a Vercel employee's Google Workspace account, then their Vercel account, and enumerated and decrypted non-sensitive environment variables. BleepingComputer reports a threat actor claiming to be ShinyHunters tried to sell allegedly stolen data; Vercel's bulletin does not mention ShinyHunters. Vercel closed the incident on 2026-10-16. The DBSC rollout is a defensive hardening item, not a vulnerability or active campaign: no CVEs, malware hashes or network IOCs are published.

Limitations documented in the W3C editor's draft and Chrome documentation: DBSC does not stop an attacker who is resident on the device and can use the browser session locally; malware present at session registration may extract the key or bind the session to a non-TPM key; it works only over HTTPS, does not support partitioned cookies, and falls back when secure key storage is unavailable. Defenders should treat DBSC as raising the cost of remote cookie replay, keep endpoint infostealer detection, and monitor for sessions that fail to register or refresh binding.

## MITRE ATT&CK

- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1078.004 Valid Accounts: Cloud Accounts
- T1199 Trusted Relationship
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Non-Browser Process Reading Chromium Memory - ChromeKatz-Style Session Cookie Theft (Lumma/Vidar/StealC)** (`TL-2026-5272-SPL-001`)

Detects a non-browser process opening chrome.exe, msedge.exe or brave.exe with memory-read access rights (Sysmon EventCode 10). This is the ChromeKatz-style in-memory cookie extraction used by Vidar, StealC and Lumma Stealer to bypass Chrome App-Bound Encryption and steal session cookies (T1539). DBSC makes stolen cookies non-replayable off-device but does not stop local theft, so the endpoint behaviour must still be detected.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1539, T1555.003, T1005
- **Data sources:** sysmon, index=windows XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 10, DeviceEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10 earliest=-24h (TargetImage="*\\chrome.exe" OR TargetImage="*\\msedge.exe" OR TargetImage="*\\brave.exe") GrantedAccess IN ("0x1010","0x1410","0x1438","0x143a","0x1fffff","0x1f3fff") NOT SourceImage IN ("*\\chrome.exe","*\\msedge.exe","*\\brave.exe","*\\MsMpEng.exe","*\\csrss.exe","*\\WerFault.exe","C:\\Program Files\\Windows Defender\\*","C:\\ProgramData\\Microsoft\\Windows Defender\\*")
| stats count min(_time) as first_seen max(_time) as last_seen values(GrantedAccess) as granted_access values(TargetImage) as browsers_targeted by host SourceImage SourceUser
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == 'ReadProcessMemoryApiCall'
| where FileName in~ ('chrome.exe', 'msedge.exe', 'brave.exe')
| where InitiatingProcessFileName !in~ ('chrome.exe', 'msedge.exe', 'brave.exe', 'MsMpEng.exe', 'MsSense.exe', 'csrss.exe', 'WerFault.exe')
| summarize Events = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), TargetBrowsers = make_set(FileName) by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, InitiatingProcessAccountName
```

### Sigma

```yaml
title: Non-Browser Process Reading Chromium Browser Memory (ChromeKatz-Style Cookie Theft)
id: 7c1a3e52-4b8d-4f6a-9c21-5d0e8a1b3f01
status: experimental
description: Detects a non-browser process opening a Chromium-based browser with memory-read access rights, the technique used by ChromeKatz and by Vidar, StealC and Lumma Stealer to extract session cookies and bypass App-Bound Encryption.
references:
    - https://www.bleepingcomputer.com/news/security/infostealer-malware-bypasses-chromes-new-cookie-theft-defenses/
    - https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.credential-access
    - attack.t1539
    - attack.t1555.003
    - attack.collection
    - attack.t1005
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
        GrantedAccess:
            - '0x1010'
            - '0x1410'
            - '0x1438'
            - '0x143a'
            - '0x1fffff'
            - '0x1f3fff'
    filter_browsers:
        SourceImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
            - '\csrss.exe'
            - '\WerFault.exe'
    filter_defender:
        SourceImage|startswith:
            - 'C:\Program Files\Windows Defender\'
            - 'C:\ProgramData\Microsoft\Windows Defender\'
    condition: selection and not 1 of filter_*
falsepositives:
    - EDR, AV or DLP agents that inspect browser processes
    - Accessibility, screen-capture or password-manager tooling
level: high
```

**Known false positives:**

- EDR, AV or DLP agents that open browser processes with read access
- Accessibility, screen-capture or password-manager software

**Tuning notes:** Allowlist your EDR/AV agent SourceImage paths after a 7-day baseline. Sysmon must log ProcessAccess for browser targets. Raise priority when SourceImage runs from user-writable paths (AppData, Temp, Downloads) or is unsigned.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Non-Browser Process Accessing Chromium Cookie and Login Data Stores via Command Line (locked: unlock with TL Creds)
- Browser Profile Archiving - Cookies, Login Data or Local State Packaged for Exfiltration (locked: unlock with TL Creds)
- Community-Observed Infostealer and Google Phishing Infrastructure Contact (5tr.org, lestvnas.icu, 37.27.4.20) (locked: unlock with TL Creds)
- Chromium Launched with Remote Debugging for Cookie Extraction over DevTools Protocol (locked: unlock with TL Creds)
- Compromised Context.ai Google OAuth App Client ID Observed in Workspace Telemetry (locked: unlock with TL Creds)
- Community-Reported Infostealer File Hash Executed or Written (TL_OSINT_Scan SHA256) (locked: unlock with TL Creds)
- Chrome/Edge App-Bound Encryption Disabled via Registry Policy (Exela Stealer Behaviour) (locked: unlock with TL Creds)
- Stolen Session Cookie Replay - Same Session ID from Multiple IPs and Countries (DBSC Gap Hunt) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Vercel rolls out new protection against stolen session cookie attacks](https://www.bleepingcomputer.com/news/security/vercel-rolls-out-new-protection-against-stolen-session-cookie-attacks/)
- [Vercel April 2026 security incident (bulletin)](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident)
- [Device Bound Session Credentials (DBSC) - Chrome for Developers](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials)
- [Device Bound Session Credentials - W3C WebAppSec editor's draft](https://w3c.github.io/webappsec-dbsc)
- [Infostealer malware bypasses Chrome's new cookie-theft defenses](https://www.bleepingcomputer.com/news/security/infostealer-malware-bypasses-chromes-new-cookie-theft-defenses/)
- [Google Chrome App-Bound Encryption - Red Canary](https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption/)
- [Hackers beat Chrome's App-Bound Encryption for session hijacking - Packetlabs](https://www.packetlabs.net/posts/hackers-beat-chromes-app-bound-encryption-for-session-hijacking/)
- [Chrome 146 deploys Device Bound Session Credentials vs malware](https://www.ctrlaltnod.com/news/chrome-146-deploys-device-bound-session-credentials-vs-malware)
- [Third-party AI hack triggers Vercel breach, internal environments accessed - Security Affairs](https://securityaffairs.com/191031/data-breach/third-party-ai-hack-triggers-vercel-breach-internal-environments-accessed.html)
- [FIDO Alliance white paper: DBSC and DPoP as complementary technologies to FIDO authentication](https://fidoalliance.org/white-paper-dbsc-dpop-as-complementary-technologies-to-fido-authentication/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5272