New "Storm" infostealer skips local decryption, sending browser data to attacker servers. Varonis shows how server-side decryption enables session hijacking, bypassing passwords and MFA.
Storm is a Windows infostealer that steals encrypted browser data, decrypts it off-device, and uses session cookies to bypass ...