The silent “Storm”: New infostealer hijacks sessions, decrypts server-side

A newly marketed infostealer called Storm (subscription-based) collects browser credentials, session cookies, autofill, crypto wallets, messaging data and files, and sends encrypted browser stores for server-side decryption to evade endpoint detection. Storm includes automated cookie restore/session-hijack features (using refresh tokens and geographically-matched SOCKS5 proxies), team/role management, operator-controlled VPS routing to resist takedowns, and active log evidence across multiple countries; pricing tiers and build characteristics are provided alongside basic IOCs.