Anatomy of a Cookie Heist — Reverse Engineering an Info-Stealer

pratik.dabhi.4u@gmail.com (Pratik) — Sun, 01 Feb 2026 10:00:00 +0000

What looked like a simple setup.exe turned out to be a stealthy info-stealer that stole Microsoft 365 session tokens from Chrome cookies — completely bypassing MFA. Here’s the full forensic breakdown.

Introduction
#

Suspicious login activity was observed from multiple geographic regions, inconsistent with known user behavior.

Digital Forensics on Pratik’s Localhost

Anatomy of a Cookie Heist — Reverse Engineering an Info-Stealer

Introduction #

Introduction
#