Non-browser process accessing browser 2FA extension storage or session cookie database (tightened)

Duo Tech@duotech

•updated Aug 14, 2026•8•0•19

Detects a non-browser process reading browser session-cookie databases or 2FA/authenticator extension local storage across 200+ targeted apps, consistent with OnyxC2's MFA-bypass and account-takeover capability.