🍪 Browser Session Deception

Planted fake session cookies in sqlite databases.

→ Explore in ATT&CK matrix (4 mappings) Deployment detail

What it is

A browser session cookie that only the lure ever holds, for a decoy application or a decoy session on a real one. Information-stealing malware harvests cookies in bulk to hijack sessions without a password. When the cookie is replayed from a new device or address, the application logs it.

Implementation requirements

Run a decoy web application or a decoy session on a real one, and issue a session cookie that only the lure ever holds
Plant it by logging in once from the target machine's browser profile, so the browser stores the cookie itself. Writing to the cookie database directly is fragile, because modern browsers encrypt cookie values
Monitoring: the application logs any request presenting that session. Information-stealing malware harvests cookies in bulk, so a replay from a new IP address or device is the signal
Safety: the session authorises nothing real. OPSEC: cookie name, domain and expiry consistent with the application it imitates
Rollback: Invalidate the session server-side. Clear it from the browser profile.
Upkeep: Refresh the session before it expires. Monthly proof-of-life replay from a test device.

Technologies

Endpoint

ATT&CK coverage 4

Technique	Tactic	Status	Confidence	Tier
T1056 Input Capture	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) BotSwindler: Tamper Resistant Injection of Believable Decoys in VM-Based Hosts for Crimeware Detection — Bait credentials injected through simulated user input were captured, and then used, by real credential-stealing malware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1056 Input Capture as an adversary behaviour.
T1539 Steal Web Session Cookie	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Browser Honeytoken Detection for Infostealers — Commercial product that plants synthetic session cookies and passwords in browser stores; replaying a stolen one against the decoy portal fires the alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1539 Steal Web Session Cookie as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1539 to its Lures activity.
T1555.003 Credentials from Web Browsers	Credential Access	confirmed	strong	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Browser Honeytoken Detection for Infostealers — Synthetic passwords and cookies planted in Chrome, Edge, Brave, Opera and Firefox credential stores; validation of a stolen one fires the alert. Detection of Breach Campaigns by using Distributed Deception — Plants honey authentication values in browser credential stores (Chrome Login Data). MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1555.003 Credentials from Web Browsers as an adversary behaviour.
T1217 Browser Information Discovery	Discovery	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1217 as highly feasible for infrastructure deception. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — DNS token: anyone resolving the decoy hostname triggers an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1217 Browser Information Discovery as an adversary behaviour. Listing bookmarks is not logged; a decoy bookmark to a canary hostname fires when visited.
↳ Honey bookmarks — industry-only evidence.

Evidence

Decoy Session Token (D3-DST) — MITRE D3FEND standard
Browser Honeytoken Detection for Infostealers — Hookset 2026 industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard