6.4 Credential Theft and Active Browser Session Hijacking
Where the Browser Keeps the Keys
To spare users constant logins, browsers persist more than passwords. Session cookies -- including HttpOnly session IDs and stored JWTs -- live in an SQLite database inside the profile directory; tokens also sit in Local Storage and extension storage; autofill and the built-in password manager hold card numbers, OTP secrets, and credentials. Chromium encrypts the sensitive columns, but the encryption key is itself stored in the profile: an AES-GCM key in the "Local State" file, wrapped by OS-level protection -- DPAPI on Windows, the Keychain on macOS.
DPAPI Is a User Boundary, Not a Malware Barrier
DPAPI derives its keys from the user's login, and the OS threat model assumes any process running as you is you. That assumption is exactly what infostealers exploit: same-user malware simply calls CryptUnprotectData on the encrypted values, or reads the profile files after launching the browser's own decryption path. There is no perimeter between "trusted app" and "malicious app" inside a user session, so cookie-store encryption slows casual inspection but stops nothing purposeful. Sandbox-level isolation, not the browser's crypto, is the only real wall.
Steal, Exfiltrate, Replay
Commercial infostealers walk the profile directories of every installed browser, unpack cookies, autofill, saved cards, and extension tokens, then POST the haul to a panel that resells logins by the gigabyte. The replay is what makes it lethal: an attacker pastes the stolen session cookie into a fresh browser and the server sees a fully authenticated request -- password already proven, MFA already passed. The victim's second factor protected a login that never happened again; the session itself became the credential.
Cutting the Replay Path
Defenses target the token's shelf life and portability: short session TTLs with idle re-auth, step-up verification for sensitive actions, and device-bound or token-bound sessions (sender-constrained, mTLS-backed) that refuse to replay from another machine. Monitor EDR for reads of browser profile paths and DPAPI calls, force a credential rotation whenever a stealer signature touches a host, and move high-value accounts to passkeys whose private material never leaves hardware -- nothing on disk for a stealer to take.
Architecture Diagram
Key Takeaways
- Browsers persist replayable auth state -- cookies, JWTs, autofill -- long after the password was typed.
- DPAPI/Keychain protection binds to the user account, so same-user malware decrypts it with a single API call.
- Stolen session cookies bypass both passwords and MFA because the session is already authenticated.
- Shrink the window: short TTLs, step-up auth, and device-bound sessions that refuse to replay elsewhere.
- Hardware-bound passkeys remove the target: nothing replayable exists on disk to steal.