'Stolen session cookies render MFA irrelevant': How $900-per-month turnkey malware is putting enterprise-grade account hijacking in the hands of rookie hackers

Android phone malware.

---

• Storm enables session hijacking that bypasses passwords and multi-factor authentication
• Attackers can restore stolen sessions remotely without triggering standard security alerts
• Malware operates server-side to process encrypted browser credentials for stealthy exploitation