Microsoft disrupted 200+ StealC and Amadey C2 domains, warning stolen cookies can bypass MFA. Review credential and session cleanup steps now.
What Microsoft disrupted and why it matters
Microsoft disrupted more than 200 StealC and Amadey command-and-control domains. Those families are built to steal browser data: passwords, autofill fields, and session cookies. The operational point of the takedown is simple—cut off the infrastructure that attackers use to pull loot and issue follow-on commands—but stolen material already collected remains usable until you invalidate it.
The warning that accompanies this kind of action is the part that changes response priorities. Stolen cookies and session tokens can let an attacker reuse an authenticated browser session without knowing the password and without completing MFA. MFA protects the login step; a live session token can skip that step entirely until the token expires or is revoked.
Treat cookie and session theft as account compromise
If StealC or Amadey may have run on a machine, assume browser sessions are untrusted. Password reset alone is not enough when the attacker already holds a valid cookie or refresh token. You need to end sessions at the identity provider, revoke app tokens, and force re-authentication so old cookies stop working.
Prioritize accounts that hold email, cloud admin rights, password managers, developer platforms, and finance tools. Those sessions are high value for lateral movement and account takeover. Sign out of all devices where the product offers that control, then sign back in only from a cleaned machine.
Credential and session cleanup checklist
- Isolate the suspect host from the network, then scan and remediate malware before trusting it again.
- Change passwords for accounts used in browsers on that host, starting with email and SSO.
- Revoke active sessions and OAuth/app tokens in each major service; do not rely on password change alone.
- Clear browser cookies, site data, and saved passwords, or reset the browser profile after cleanup.
- Re-enable or re-enroll MFA on a clean device, and review recovery codes and secondary factors for unauthorized changes.
- Review recent sign-ins, new devices, mail forwarding rules, API keys, and unexpected app consents.
Work from a known-clean machine when you perform resets and revocations. Using the infected browser to “fix” accounts can re-expose new credentials and new session cookies to the same stealer.
Hardening after the immediate cleanup
After sessions are killed and credentials rotated, reduce how much a future cookie theft can do. Prefer phishing-resistant MFA where available, shorten session lifetimes for sensitive apps, and avoid long-lived “stay signed in” options on shared or high-risk devices. Keep browsers and extensions updated, limit unnecessary password saving in the browser, and store secrets in a manager that does not dump everything into a single easily scraped store.
For teams, treat this as a playbook moment: confirm endpoint detection coverage, push a forced re-auth or token revocation policy where you can, and tell users that a password change without session revoke leaves MFA-bypass risk in place. The domain takedown weakens attacker infrastructure; your cleanup work is what invalidates the cookies and credentials already stolen.