Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

Malicious browser extension → cookie harvest → ATO

Publish a useful-looking extension (ad-blocker / PDF reader). It quietly reads cookies + localStorage from sensitive sites and ships them to the attacker.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: attacker publishes a Chrome / Edge / Firefox extension to the official store with cookies + <all_urls> permission. The extension passes initial review (or attacker rotates after).

§ Steps

  1. 01
    Replay sessions against M365 / SSOInitial Access
    T1078— Valid Accounts
  2. 02
    Victims install (organic / ad)Execution
    T1204— User Execution
  3. 03
    Cookies + localStorage exfilCredential Access
    T1539— Steal Web Session Cookie
  4. 04
    Mailbox / SharePoint exfilCollection
    M365-EWS-EXFIL— Exchange Web Services (EWS) Exfil
  5. 05
    Publish to web storeResource Development
    T1583— Acquire Infrastructure
  6. 06
    Build benign-looking extensionInitial Access
    BX-MALICIOUS-EXT— Malicious Browser Extension

§ References

§ Frequently asked

What is the "Malicious browser extension → cookie harvest → ATO" attack path?
Publish a useful-looking extension (ad-blocker / PDF reader). It quietly reads cookies + localStorage from sensitive sites and ships them to the attacker. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Replay sessions against M365 / SSO (T1078) — a initial access primitive. Assumed environment: attacker publishes a Chrome / Edge / Firefox extension to the official store with cookies + <all_urls> permission.
What is the final impact of this kill-chain?
The final step lands on Build benign-looking extension (BX-MALICIOUS-EXT), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers