VULNpocalypse
InformationalEcosystem changeMonitoring

Group-IB reports infostealer logs feed banking fraud via stolen sessions

Group-IB says stolen infostealer logs and session cookies can bypass MFA in bank fraud; reset credentials and revoke sessions for exposed users.

Published
Exploitation
Not confirmed as a specific incident. Group-IB describes the technique in general terms and names no victim bank in the excerpt available.

What happened

According to Group-IB, in a blog post dated November 6, 2026, infostealers are a “supply line” for fraud and not a one-off infection event. This is a single vendor’s analysis, and no independent outlet carries the story. Group-IB

Group-IB says a stealer copies saved browser passwords, session cookies, autofill details and corporate logins from a victim’s device. It calls this package a “log”. It claims the same log is resold for four crimes: account takeover, mule account onboarding, session hijacking and ransomware. Group-IB

Group-IB also says multi-factor authentication does not stop a stolen session cookie, because the cookie is issued after the password and second factor have been passed. It says the cookie works until the session ends. Group-IB

The post cites INTERPOL’s Operation Secure, which Group-IB says ran from January to April 2025 across Asia and the South Pacific. Group-IB reports these results:

  • More than 20,000 malicious IP addresses and domains taken down.
  • 41 servers seized.
  • Over 100 GB of data recovered.
  • 32 arrests across Vietnam, Sri Lanka and Nauru.
  • More than 216,000 victims and potential victims notified and told to change passwords and check their accounts for unauthorized access.

Group-IB says it contributed intelligence on the Lumma, Risepro and METAStealer families. Group-IB

Not confirmed: any specific bank, victim, loss figure or newly disclosed vulnerability. The six-week scenario in the post is presented as an illustration. The available text of the post is cut off during its discussion of Phantom Stealer, so details of that research are not confirmed here.

Am I affected?

The source names no specific product or version. Based on Group-IB’s description, the exposure applies to anyone whose browser stored banking or corporate logins on a device that may have carried an infostealer. Group-IB says the infection can go unnoticed by both the customer and the bank. Whether a particular account is affected is not confirmed by the source.

What to do now

  1. If you may have been exposed, change passwords and check accounts for unauthorized access. Group-IB says this is what INTERPOL told notified victims to do. Group-IB
  2. Do not assume MFA protects an already-issued session. Group-IB says a stolen cookie works until the session ends, so ending active sessions for suspected accounts follows from that description. The source excerpt does not list specific remediation steps.
  3. Treat compromised devices as the origin. Group-IB’s examples include free tool downloads and sponsored search results that mimic tools users already use.
  4. Read the full Group-IB post for its recommendations, since the excerpt available here is incomplete.

Sources