Skip to content

Steal Web Session Cookie

Technique · ATTACK:enterprise:T1539

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1539",
  "title": "Steal Web Session Cookie",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1539",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--10ffac09-e42d-4f56-ab20-db94c67d76ff",
  "external_id": "T1539",
  "domain": "enterprise",
  "created": "2019-10-08T20:04:35.508Z",
  "modified": "2026-05-12T15:12:00.621Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Krebs Discord Bookmarks 2023",
      "url": "https://krebsonsecurity.com/2023/05/discord-admins-hacked-by-malicious-bookmarks/"
    },
    {
      "source_name": "Unit 42 Mac Crypto Cookies January 2019",
      "url": "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"
    },
    {
      "source_name": "Kaspersky TajMahal April 2019",
      "url": "https://securelist.com/project-tajmahal/90240/"
    },
    {
      "source_name": "Github evilginx2",
      "url": "https://github.com/kgretzky/evilginx2"
    },
    {
      "source_name": "GitHub Mauraena",
      "url": "https://github.com/muraenateam/muraena"
    },
    {
      "source_name": "Pass The Cookie",
      "url": "https://wunderwuzzi23.github.io/blog/passthecookie.html"
    },
    {
      "source_name": "Talos Roblox Scam 2023",
      "url": "https://blog.talosintelligence.com/roblox-scam-overview/"
    }
  ]
}

Explicit source assertions (36)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--002f1039-f4c5-4c60-b8ac-ced374bec2ac

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15c72607-0bf4-4740-8754-2bb1547111bb

S2W Troll Stealer 2024 · Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a5bf948-33fd-4025-aadd-117e99512e6a

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c61ec55-92dd-4bab-8a1d-fcadafc17dfe

Leonard TAG 2023

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e526bd3-f353-4b05-a9c9-1f8ddc59bc33

IBM Grandoreiro April 2020

ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--248a0d72-d9cd-43d3-985f-a33a49a79e8b

Token tactics · Session Management Cheat Sheet

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24b6a0ed-7c56-4dfa-be1b-97388f7a0bb1

Intrinsec_Vidar_April2026 · LevelBlue_Vidar_May2026

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--354cf266-b6f5-4ced-a704-65d1858212d4

Google XLoader 2017

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35b7c6d7-521c-41f6-81fc-af2f67d8ad82

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fd05c59-c28b-418a-be56-87ff52d4771c

ESET EvilNum July 2020

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42d78c28-8a26-4cac-88bb-93e35d5226e4

Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026

ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44c91929-3473-443c-91be-5afa81582dfa

ATTACK:enterprise:S0492 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--474e148d-4f4a-41d4-994e-d6425c7445f3

Unit42 CookieMiner Jan 2019

ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b5922d7-d1cf-4e5d-84c9-4e7e8ac4a6a5

Sophos Evilginx MAR 2025 · Evilginx 2 July 2018

ATTACK:enterprise:S9044 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e4d727b-d8fe-412d-81d6-6028a4ea307c

Artic Wolf Labs Kali365 Device Code April 2026 · SpyCloud Kali365 June 2026

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55409bd6-f45c-479c-9557-d8efff292789

CISA Star Blizzard Advisory December 2023

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b252d63-e2a1-4ad3-aadd-96bc8dee78da

Cisco LotusBlossom 2025

ATTACK:enterprise:S1140 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6608d133-27ba-4bd9-bcd4-5becca5a8018

Google TAG COLDRIVER January 2024

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a1cf82e-68e5-49ca-89ae-e492cd85dab4

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f92fc3c-044c-4095-be4b-f6482a5619d1

Kroll Qakbot June 2020 · Kaspersky QakBot September 2021

ATTACK:enterprise:S0568 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8785b9f9-52dd-4bf5-8e88-b80c4c28dc7f

Prevailion EvilNum May 2020

ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8af30aa3-c5b7-4273-9de4-98fe5b2f4bf5

Zscaler Kimsuky TRANSLATEXT

ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f6ffa28-0a5d-4adc-8789-17f3d83446a0

Cybereason Chaes Nov 2020

ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--953091ba-9d00-41ba-8727-014f6d11b5d3

Volexity InkySquid BLUELIGHT August 2021

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95add276-6a4d-4281-82e5-7857b615742b

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98847982-f5fe-4c8e-bd90-b24ba3ff58bd

ESET RedLine Stealer November 2024 · Kroll RedLine Stealer August 2024 · Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ffa7daa-ce47-4333-87ac-e438b7556b0c

ESET EvasivePanda 2023

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a27be16a-0132-4895-8f62-2bcc31cf15d7

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--acfadf9a-afa5-413e-8855-a96947c5ab26

trendmicro xcsset xcode project 2020

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9b622ad-856a-48f9-a768-ef05bd2914fe

Kaspersky TajMahal April 2019

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c54f50fe-017e-4015-8277-4d50f3ed0d97

Rapid7 BlackBasta 2024

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8c19b7a-71a0-4941-9244-f9784e5e99fc

Sekoia Raccoon2 2022

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db995d8c-b561-4fdc-9c5b-a19b2383c058

TrendMicro LummaStealer 2025 · Fortinet LummaStealer 2024 · Cybereason LumaStealer Undated

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1062063-0f27-443e-9d6f-2dee44ee79aa

Mandiant APT42-charms

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef10f1da-2388-4404-97aa-bcfa9bcd27ec

ESET MirrorFace DEC 2022

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1539

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f780f9d8-1baa-41b7-b7a1-acba717df0ab

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.