The silent “Storm”: New infostealer hijacks sessions, decrypts server-side

Storm surfaced on April 13th when BleepingComputer published what amounts to a structural autopsy of a new infostealer that breaks from the template most security teams have spent years defending against. The name is unremarkable. The architecture is not. Where conventional credential stealers rifle through browser storage — saved passwords, autofill data, local credential databases — Storm takes a different approach entirely. It hijacks active browser sessions, capturing authentication that has already succeeded. That distinction matters enormously: it means the question of whether a victim uses a strong password, or even a password manager, becomes largely irrelevant. The session token is the key, and Storm takes the key. The second structural oddity is where the real analytical weight sits: decryption happens server-side. Storm doesn't process what it steals on the victim's machine. It exfiltrates encrypted data back to infrastructure the attackers control, where decryption occurs. This design choice is deliberate — it makes forensic analysis significantly harder, because investigators examining a compromised endpoint find less to work with. The malware leaves a thinner footprint by offloading the sensitive computational work to somewhere defenders cannot reach.

If confirmed, here is what this means. The session-hijacking model represents a genuine architectural shift in the threat landscape, and the defensive implications run downstream fast. Multi-factor authentication, which has become the default recommendation for credential protection, offers substantially reduced protection against session token theft — the MFA challenge was already passed before Storm arrived. Enterprise security teams relying on "we have MFA deployed" as a risk mitigation will need to reconsider that position with some urgency. The server-side decryption design raises a separate concern: it suggests a level of operational sophistication that points toward a threat actor who has thought carefully about longevity and counter-forensics, not someone deploying commodity tooling. For incident responders, that means standard endpoint investigation playbooks may surface less evidence than usual, potentially leaving organizations uncertain about the true scope of a compromise. The second-order effect is confidence erosion in session-based authentication models broadly — something that has structural implications for how SaaS platforms, enterprise tools, and remote access systems think about session lifetime, anomaly detection, and forced re-authentication intervals.

Watch for independent malware researchers or antivirus vendors publishing their own technical analyses of Storm's codebase — that would rapidly shift the reliability picture. Any confirmed victim disclosures or law enforcement acknowledgment would be the signal that this has moved from documented threat to active campaign.

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →