{"id":24428,"date":"2026-05-28T10:26:09","date_gmt":"2026-05-28T03:26:09","guid":{"rendered":"https:\/\/fpt-is.com\/en\/?post_type=goc_nhin_so&p=24428"},"modified":"2026-07-14T09:57:47","modified_gmt":"2026-07-14T02:57:47","slug":"the-underground-access-economy-storm-infostealer-and-the-era-of-passwordless-attacks","status":"publish","type":"goc_nhin_so","link":"https:\/\/fpt-is.com\/en\/insights\/the-underground-access-economy-storm-infostealer-and-the-era-of-passwordless-attacks\/","title":{"rendered":"The underground access economy: Storm Infostealer and the era of passwordless attacks"},"content":{"rendered":"

Executive Summary<\/span><\/h2>\n

In early 2026, Varonis Threat Labs identified\u00a0Storm<\/strong> – a new infostealer circulating on underground cybercrime networks for under $1,000 per month. Storm is not simply another commodity stealer: it represents the next evolutionary step in how attackers compromise digital identities without ever needing a password or triggering MFA<\/strong>.<\/span><\/p>\n

Varonis’ panel analysis confirmed\u00a01,715 victims<\/strong>\u00a0across multiple countries, including\u00a0Vietnam<\/strong>. A single Storm-infected browser can hand an operator authenticated access to an organization’s entire SaaS estate, cloud environment, and internal tools – through valid, already-authenticated session cookies, without triggering any password-based detection.<\/span><\/p>\n

Storm does not exist in a vacuum. It is a product of a\u00a0mature access economy<\/strong> – an underground ecosystem where every link in the attack chain has been specialized, priced, and commoditized.<\/span><\/p>\n

Highest priority action:<\/strong>\u00a0Immediately review browser-based credential storage policy for privileged accounts, and enable alerting for impossible travel and fresh token anomalies in Entra ID \/ Google Workspace.<\/span><\/p>\n

1. The Access Economy: When attacks become an industry<\/span><\/h2>\n

“Attackers don’t break in, they log in” is no longer just a warning – it is an accurate description of a functioning business model.<\/span><\/p>\n

Underground marketplaces now operate with the full infrastructure of a legitimate market: reputation systems for sellers, escrow to guarantee transactions, role specialization, and tiered pricing by target value. One operator runs infostealers across thousands of machines. Another extracts and sorts credentials. A third sells curated access. A fourth deploys ransomware. Each party focuses on their specialty, and the entire chain operates with disturbing efficiency.<\/span><\/p>\n

Four primary product categories are traded in this market:<\/span><\/p>\n

1.1 Remote access credentials<\/span><\/h3>\n

VPN and RDP credentials are listed with full metadata: organization name, geographic region, industry, and VPN product in use. Pricing scales with target value. Varonis documented a confirmed seller offering\u00a0seven Fortinet SSL VPN credentials<\/strong> targeting educational institutions – a lower-value market. Credentials for financial organizations or government agencies command significantly higher prices, sometimes with “exclusive access” guarantees – meaning the seller will not sell the same access to multiple buyers simultaneously.<\/span><\/p>\n

1.2 Infostealer logs<\/span><\/h3>\n

This is the largest product category by volume. Infostealer families including Redline, Raccoon, Vidar, Lumma, and Risepro harvest browser-saved passwords, session cookies, autofill data, cryptocurrency wallet seeds, and authentication tokens – then distribute structured, searchable logs through subscription channels.<\/span><\/p>\n

DAISY CLOUD<\/strong>\u00a0is a representative example: a stealer log distribution service operating on subscription at $400 for seven days or $1,350 per month. Logs are indexed and searchable by credential type, country, and platform.<\/span><\/p>\n

Session cookies are the highest-value product in this category. If an infostealer captures a valid cookie, an attacker can import it directly into a browser and inherit the fully authenticated session – no password needed, no MFA prompt triggered<\/strong>.<\/span><\/p>\n

1.3 Breach databases<\/span><\/h3>\n

Data from historical breaches is categorized by geography, sector, freshness, and field completeness (does the record include email + phone + password hash?). This data serves multiple purposes: credential stuffing, organizational reconnaissance, and building employee profiles for targeted spear-phishing.<\/span><\/p>\n

One example documented in Varonis research: a dump from three Egyptian government ministries containing 24,000 HTML files and thousands of PDFs with citizen records.<\/span><\/p>\n

1.4 Web shells and backdoors<\/span><\/h3>\n

Web shells bypass authentication entirely. These are backdoors planted on already-compromised servers that give buyers command execution capability over HTTP without any credentials. Once installed, a web shell persists independently of the original vulnerability – patching the vulnerability does not remove the shell.<\/span><\/p>\n

One listing Varonis documented: root RCE and shell access to a\u00a0government revenue management system<\/strong> (Linux, root-level permissions) – priced at $400, from a seller with a reputation score of 61 built over four months of operation.<\/span><\/p>\n

2. Storm – A next-generation Infostealer<\/span><\/h2>\n

Storm is the clearest evidence of where infostealers are heading: from raw data dumping tools to\u00a0automated identity takeover platforms<\/strong>.<\/span><\/p>\n

2.1 Technical context: Why server-side decryption matters<\/span><\/h3>\n

Traditional infostealers decrypted browser credentials on the victim’s machine by loading SQLite libraries and directly accessing credential stores. EDR and endpoint security tools adapted to this – anomalous access to browser databases became one of the clearest signals of malicious activity on an endpoint.<\/span><\/p>\n

In July 2024, Google deployed\u00a0App-Bound Encryption<\/strong>\u00a0in Chrome 127, binding encryption keys to the Chrome process itself and making local decryption significantly harder. This is where Storm and next-generation stealers pivoted: rather than decrypting on the endpoint, they\u00a0exfiltrate the encrypted data blob to the attacker’s server and decrypt it there<\/strong>.<\/span><\/p>\n

The result: no suspicious SQLite access on the endpoint, no browser credential store access anomaly – the signals that EDR was trained to detect are simply absent.<\/span><\/p>\n

2.2 Data collected<\/span><\/h3>\n

Storm harvests everything an operator needs to restore a hijacked session remotely:<\/span><\/p>\n

    \n
  • Saved passwords and autofill data<\/span><\/li>\n
  • Session cookies (all browsers)<\/span><\/li>\n
  • Google account tokens and refresh tokens<\/span><\/li>\n
  • Browser-saved credit card data<\/span><\/li>\n
  • Browsing history<\/span><\/li>\n
  • Session data from\u00a0Telegram, Signal, and Discord<\/strong><\/span><\/li>\n
  • Cryptocurrency wallets via both browser extensions and desktop apps<\/span><\/li>\n
  • Documents from user directories<\/span><\/li>\n
  • System information and screenshots Storm handles both\u00a0Chromium-based browsers<\/strong>\u00a0(Chrome, Edge, Brave) and\u00a0Gecko-based browsers<\/strong> (Firefox, Waterfox, Pale Moon) – entirely server-side. This distinguishes it from StealC V2, which still processes Firefox locally.<\/span><\/li>\n<\/ul>\n

    2.3 The Session restore feature: The most dangerous capability<\/span><\/h3>\n

    After decrypting the stolen data, Storm does not simply dump credentials into an operator panel for manual exploitation. It\u00a0automates the next step<\/strong>:<\/span><\/p>\n

      \n
    1. The operator supplies the victim’s Google Refresh Token into the panel<\/span><\/li>\n
    2. Combined with a SOCKS5 proxy geographically matched to the victim (same country\/ISP)<\/span><\/li>\n
    3. The panel silently restores the victim’s authenticated session The result: the operator has a live, authenticated session originating from a geographically plausible IP address, triggering no password-based alerts. Every SaaS platform the victim was logged into – Microsoft 365, Google Workspace, Salesforce, internal tools \u2014 is now accessible to the attacker.<\/span><\/li>\n<\/ol>\n

      This technique is not new: Varonis’\u00a0Cookie-Bite<\/strong>\u00a0research demonstrated that stolen Azure Entra ID session cookies completely neutralize MFA.\u00a0SessionShark<\/strong>\u00a0showed phishing kits intercepting session tokens in real time. Storm is the\u00a0productization<\/strong> of these known techniques – packaged into a subscription service with operator-friendly UX.<\/span><\/p>\n

      2.4 Confirmed scope<\/span><\/h3>\n

      Varonis found\u00a01,715 entries<\/strong>\u00a0in panel data, originating from Brazil, Ecuador, India, Indonesia,\u00a0Vietnam<\/strong>, and the United States. While not all entries can be confirmed as genuine victims (test data may be included), the diversity of IP addresses, ISPs, and data sizes indicates\u00a0active malicious campaigns<\/strong>\u00a0are ongoing.<\/span><\/p>\n

      Stolen credentials cover a range of high-value platforms including Google, Facebook, Twitter\/X, financial accounts, and corporate SaaS.<\/span><\/p>\n

      3. Kill chain<\/span><\/h2>\n
      [Infection Vector]\r\nPhishing email \/ Malicious download \/ Compromised third-party tool\r\n         \u2502\r\n         \u25bc\r\n[Collection \u2014 Endpoint]\r\nStorm harvests: passwords, cookies, tokens, wallets, documents\r\n\u2192 No<\/span> local<\/span> decryption, no<\/span> direct SQLite access<\/span>\r\n\u2192 Packages data as<\/span> encrypted<\/span> blob\r\n         \u2502\r\n         \u25bc\r\n[Exfiltration \u2192 C2 Server<\/span>]\r\nEncrypted<\/span> blob shipped to<\/span> attacker-controlled server<\/span>\r\n         \u2502\r\n         \u25bc\r\n[Server<\/span>-Side Decryption]\r\nAttacker server<\/span> decrypts all<\/span> browser data\r\n\u2192 Credentials and<\/span> session<\/span> cookies dumped to<\/span> operator<\/span> panel\r\n         \u2502\r\n         \u25bc\r\n[Session<\/span> Restore \u2014 Automation]\r\nGoogle Refresh<\/span> Token + SOCKS5 proxy (geo-matched to<\/span> victim)\r\n\u2192 Panel silently restores authenticated session<\/span>\r\n         \u2502\r\n         \u25bc\r\n[Impact]\r\nAuthenticated access<\/span> to<\/span> SaaS, cloud, internal<\/span> tools\r\n\u2192 No<\/span> password<\/span> alert triggered, no<\/span> MFA required\r\n<\/code>