Your Employees Logged In Without Issue; Attackers Logged In Too.

Constella reports discovery of malicious Chrome extensions and widespread infostealer activity that continuously harvest and exfiltrate session cookies for enterprise HR/ERP and SaaS platforms; stolen cookies allow attackers to hijack authenticated sessions without triggering MFA or login events, enabling large-scale silent access (illustrated by the Snowflake incidents), and the report recommends cookie monitoring, session invalidation, and extension auditing to mitigate the threat.