A recent threat intelligence report highlights the emergence of a sophisticated cyberattack technique known as Browser-in-the-Middle (BitM), which allows hackers to hijack user sessions across various web applications in a matter of seconds.
This method exploits the inherent functionalities of web browsers to deceive victims into believing they are interacting with a secure connection, while in reality, their actions are being performed on the attacker’s machine.
Exploiting Session Tokens
BitM attacks target session tokens, which are stored in a user’s browser after completing multi-factor authentication (MFA).
These tokens are crucial for maintaining an authenticated state, making them a prime target for adversaries.
Traditional methods, such as using transparent proxies like Evilginx2, require significant customization and can be time-consuming.
In contrast, BitM offers rapid targeting capabilities with minimal configuration, allowing hackers to reach any website quickly.
Defense Strategies
To counter these threats, organizations are advised to implement robust defenses.
Mandiant suggests using client certificates and hardware-based MFA solutions like FIDO2-compatible security keys.
These measures can effectively deter BitM attacks by requiring authentication elements that are difficult for attackers to manipulate.
For instance, FIDO2 keys ensure that authentication responses are tied to the request’s origin, preventing attackers from replaying them on different sites.
However, these protections are only effective if the device hosting the security keys or certificates remains uncompromised, emphasizing the need for a layered security approach.
The development of internal tools like Delusion by Mandiant demonstrates the potential scale of BitM attacks.
Delusion allows operators to target applications without prior knowledge of their authentication protocols, making session-stealing attacks more accessible.
While Mandiant has chosen not to publish Delusion due to weaponization concerns, open-source alternatives like EvilnoVNC and Cuddlephish are available for testing defenses against such threats.
As BitM attacks continue to evolve, organizations must prioritize robust authentication and access-control mechanisms to protect sensitive data and networks.
Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.
