NEW INFOSTEALER 'STORM' BYPASSES MFA WITH SERVER-SIDE DECRYPTION

A new infostealer called Storm steals encrypted browser data and decrypts it on attacker-controlled servers, enabling session hijacking and password bypass. Security researchers at Varonis revealed the technique sidesteps traditional local decryption detection.