New 'Storm' Infostealer Remotely Decrypts Stolen Credentials

Varonis researchers reported a new infostealer called Storm that emerged in early 2026 and steals saved passwords, session cookies, autofill data, Google tokens, credit cards, browser and desktop crypto wallets, documents, screenshots and messaging session data; it exfiltrates encrypted files to attacker servers for decryption and automates session restoration using Google refresh tokens and geographically matched SOCKS5 proxies, enabling silent account takeovers and fraud, and has been observed in panels with thousands of entries across multiple countries.