Unverified60% confidenceFactExact time
The attack was a session hijacking attack (Session Grabber), in which the attacker bypassed password verification and directly took over accounts by stealing browser session cookies.
2
Sources
60%
Confidence
Long-term
Relevance
9/11/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedInformation-stealing trojans steal passwords saved in browsers, cookies, cryptocurrency wallet private keys, and session tokens.73% similarUnverified凭证填充攻击（Credential Stuffing）指攻击者将一处泄露的用户名密码组合自动化尝试登录其他网站以接管账户72% similarUnverifiedIn the 2021 ua-parser-js poisoning incident, an attacker hijacked the package maintainer's account and injected a mining program and a password stealer into three versions; affected downstream projects included internal tools of major tech companies such as Facebook and Microsoft.71% similarUnverifiedAfter a successful attack, the attacker can steal local sensitive credentials, including API Keys, GitHub Tokens, and cloud service keys.70% similarUnverifiedThe attack can steal sensitive credentials such as API keys and access tokens from the victim's development environment.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/906589API
curl https://kongchang.com/api/v1/knowledge/claims/906589MCP
get_claim(id=906589)