Threat video1:00
Lumma & RisePro Session Cookie Fraud: Detection & IOCs
Lumma, RisePro and METAStealer session theft bypasses MFA on banking accounts. Ships 9 detection rules, 16 IOCs and a free Splunk SPL rule.
Read the full threat intel for Lumma & RisePro Session Cookie Fraud: Detection & IOCs →
Chapters
- 0:00The hookStolen cookies silently hijack accounts without MFA.
- 0:05The storyCookies copied, replayed without authentication.
- 0:11Attack pathPhishing archive delivers the stealer.
- 0:28AttributionNo threat actor is attributed.
- 0:33Indicators of compromise12 indicators to hunt: 8 IPs and 4 domains.
- 0:38MITRE ATT&CK techniques17 ATT&CK techniques, from resource development to impact.
- 0:43Remediation4 steps now: Invalidate and reissue session tokens, cookies and SSO sessions.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Stolen cookies silently hijack accounts without MFA.
0:05Cookies copied, replayed without authentication.
0:08Four separate crimes from one log.
0:11Phishing archive delivers the stealer.
0:13Victim executes; stealer harvests passwords and session cookies.
0:18Cookies already authenticated; replaying skips MFA.
0:22Attacker replays the session.
0:23Accounts drain; mule accounts onboard.
0:28No threat actor is attributed. Confidence: low.
0:3312 indicators to hunt: 8 IPs and 4 domains.
0:3917 ATT&CK techniques, from resource development to impact.
0:444 steps now: Invalidate and reissue session tokens, cookies and SSO sessions.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.