Dough No! Revisiting Cookie Theft

This report explains Chrome and Edge’s shift to App-Bound encryption for cookie protection and details four practical techniques adversaries can still use to steal cookies: leveraging the DecryptData COM interface, reproducing SYSTEM-bound decryption (including Chrome-specific PostProcessData flows on domain-joined and non-domain hosts), enabling remote debugging to extract cookies via DevTools, and loading custom extensions to harvest cookies. It offers accompanying detections such as DPAPI debug event auditing, Sysmon CreateRemoteThread and ProcessAccessed monitoring, process creation flag detection for remote-debugging and load-extension switches, and extension ID auditing, while providing tooling references (e.g., Cookie-Monster and helper scripts) for red and blue teams.