Group-IB argues stolen session cookies make MFA a late checkpoint in banking fraud

Group-IB published a blog post on 6 November arguing that banks are still treating infostealer infections as one-off incidents when they function more like a supply line. The post is analysis and vendor framing, not a report of a new intrusion.

Its core claim is mechanical. A stealer takes saved logins, session cookies, autofill data and, increasingly, corporate single sign-on tokens sitting in the same browser as online banking. That bundle, a "log", gets refined and resold, and the post says four different buyers use it: account takeover, mule account onboarding, session hijacking and ransomware.

The part worth reading twice is the cookie. Multi-factor authentication is passed before the cookie is issued, so replaying a stolen cookie skips the login and the one-time code. The post puts it bluntly: the stealer didn't defeat the authentication, it waited until the customer passed it and copied the receipt.

For scale, Group-IB cites INTERPOL's Operation Secure, run between January and April 2025 across Asia and the South Pacific, which it contributed intelligence to. The post says the operation took down more than 20,000 malicious IP addresses and domains, seized 41 servers and led to 32 arrests across Vietnam, Sri Lanka and Nauru. It also says more than 216,000 victims and potential victims were notified and told to change passwords and check their accounts.

The post's own conclusion is that counting infected devices is the wrong measure; counting valid credentials still in circulation is the right one. We'd agree with the direction, though the post doesn't offer a way to get that count, and nothing here says how many logs are currently for sale.

What a defender can act on is narrower than the framing. Session revocation and shorter session lifetimes matter as much as password resets, and browser-stored corporate tokens deserve the same suspicion as a phished password.