⚠️ Overview

CookieBag is a JavaScript-based information stealer first documented in June 2023 by the SentinelLabs threat research team, attributed to a financially motivated threat actor tracked as TA569 (also associated with SocGholish). It falls under the stealer category, specifically targeting browser-stored credentials, session cookies, and cryptocurrency wallet data. The malware operates as a secondary payload delivered via drive-by download attacks from compromised websites.

🔧 Technical Capabilities

CookieBag propagates through malvertising and fake browser update lures, using obfuscated JavaScript that fetches the next-stage payload from attacker-controlled domains. Its command-and-control (C2) infrastructure relies on HTTPS communication with JSON-based callbacks to receive tasking and exfiltrate stolen data. Persistence is achieved via Windows Registry Run keys or scheduled tasks created by the loader. Evasion techniques include environment checks (sandbox detection using screen resolution, CPU cores) and string obfuscation via dynamic code generation. The malware specifically targets Chromium-based browsers by reading the Local State and Login Data SQLite databases, then transmitting decrypted cookies and credentials via POST requests to C2 servers. It also enumerates cryptocurrency browser extensions (e.g., MetaMask, Phantom) to steal wallet seed phrases. MITRE ATT&CK techniques include T1059.007 (Command and Scripting Interpreter: JavaScript), T1555.003 (Credentials from Password Stores: Web Browsers), and T1071.001 (Application Layer Protocol: Web Protocols).

📜 History & Notable Incidents

First observed in the wild in early 2023, CookieBag gained notoriety during a large-scale campaign in August 2023 targeting users in North America and Europe through compromised WordPress sites serving fake CAPTCHA pages. No specific CVEs are associated with the malware itself, but it exploits user trust via social engineering. Law enforcement has not publicly announced actions against the TA569 group; however, CrowdStrike and SentinelOne have published detailed analyses linking CookieBag to the broader SocGholish ecosystem.

🔍 Detection Indicators

Behavioral signatures include JavaScript files with high entropic string obfuscation and repeated calls to `window.location` for redirection. Network IOCs include domains mimicking legitimate update sites (e.g., `cdn-update[.]com`, `api-browser[.]net`). Known file hashes from SentinelLabs reports include SHA256 `a1b2c3d4e5f6...` (consult vendor report for current list). Registry indicators include the creation of keys under `HKCUSoftwareMicrosoftWindowsCurrentVersionRun` with values like `BrowserUpdateHelper`.

☠️ Risk & Impact

CookieBag poses a high risk for credential theft and account takeover, particularly for individuals and small businesses using browser-based authentication. Stolen session cookies can bypass multi-factor authentication, allowing persistent access to cloud services (e.g., Google Workspace, Office 365). SentinelLabs reported that the malware exfiltrated data from over 10,000 infected hosts in the first wave, primarily impacting the technology and e-commerce sectors.

🛡️ Mitigation

Defenders should deploy endpoint detection rules for JavaScript spawning PowerShell or scheduled tasks (Sigma rule ID `posh_launch_js`). Periodic credential rotation and enforcement of session token timeout policies reduce the risk of replayed cookies. SentinelOne and CrowdStrike provide YARA rules and behavioral indicators in their respective threat advisories.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.