Credential Access via Chromium Remote Debugging

Adversaries may attempt to steal web session cookies by launching Chromium-based browsers with remote debugging arguments. This technique leverages legitimate browser functionality - specifically the remote debugging port - to allow an external actor to attach to a running browser instance, inspect its contents, and extract sensitive authentication cookies. By capturing these cookies, an attacker can impersonate a user, gaining access to web applications and services without requiring the original credentials or bypassing multi-factor authentication.

This activity is frequently associated with information-stealing malware and manual post-exploitation tasks. While Chromium-based browsers provide these debugging ports for legitimate development and testing, their misuse in a production or end-user environment is highly suspicious. Defenders should monitor for processes such as Google Chrome and Microsoft Edge being executed with specific debugging flags, particularly when paired with a custom user data directory argument, which allows the attacker to isolate the target browser instance.

Impact

Successful exploitation allows attackers to bypass primary authentication and MFA, leading to full session hijacking of web applications. This results in unauthorized access to sensitive corporate data, SaaS platforms, and internal services, potentially leading to data exfiltration, service manipulation, or further persistence within the target environment.

Recommendation

• Deploy the Sigma rules provided below to detect browsers launched with debugging arguments in non-development environments.
• Implement endpoint security policies to block or alert on the use of remote debugging arguments (--remote-debugging-port, --remote-debugging-pipe) for standard user accounts.
• If a positive match is found, isolate the affected host and immediately invalidate all active web sessions for the user account associated with the process to mitigate the impact of potentially stolen cookies.
• Conduct a review of account logs to identify unauthorized logins to web services originating from anomalous IP addresses or sessions immediately following the detected process execution.