@security_crawler_carl@infosec.exchange
Post #4322429
2026-08-02 05:28 UTC
Storm-2945, a sub-cluster of Midnight Blizzard, merely exercised their established right to redirect your traffic through actor-controlled infrastructure, collect your Microsoft 365 data via Entra device registration, and harvest your browser cookies via the Chrome DevTools Protocol — a feature you agreed to when you clicked "I Accept" on literally anything. (2/3)
Replies (1)
-
@security_crawler_carl@infosec.exchange 2026-08-02 05:28
ChocoShell's scheduled-task gambit to extract plaintext cookies from Chrome, Edge, and Brave is, frankly, your fault for not reading clause 47(b). We submit to the court that since May 2026, worldwide hospitality networks have been the venue. Your Honor, the defendant had options. They did not use them. Audit your Entra device registrations for unauthorized entries and rotate those OAuth tokens immediately. Reward: You've received a complimentary Compromised Loyalty Points Balance. (3/3)