Cookie-Bite Attack: Chrome Extension Exploit Bypasses MFA in Azure Entra ID

A newly documented proof-of-concept attack named “Cookie-Bite” demonstrates how malicious Chrome extensions can hijack browser session cookies from Azure Entra ID, bypassing multi-factor authentication (MFA) and maintaining persistent access to Microsoft 365 services. The attack, which leverages PowerShell for persistence and Google Forms for exfiltration, was undetected by all 60 security vendors on VirusTotal at the time of discovery¹.

Attack Mechanics and Impact

The Cookie-Bite attack targets Azure Entra ID session cookies (ESTAUTH and ESTSAUTHPERSISTENT), which remain valid even after MFA completion. The malicious extension monitors login events to Microsoft services, then uses a PowerShell script to reinject stolen cookies automatically. This allows attackers to maintain access even if the victim changes their password².

Dark Reading’s analysis confirms the attack enables lateral movement within cloud environments, with potential for data theft and privilege escalation³. The technique aligns with MITRE ATT&CK’s T1539 (“Steal Web Session Cookie”), previously seen in APT42 and DarkGate campaigns⁴.

Limitations of Current Defenses

Traditional cookie security measures prove ineffective against this attack vector:

Signed Cookies: Cryptographic integrity checks prevent tampering but don’t block theft
One-Time Cookies: Extensions can disable OTC headers before transmission
Token Binding: TLS-bound cookies remain vulnerable to extension-based theft

The proposed CREAM framework (BrowserOnly and Monitored attributes) shows promise in blocking JavaScript/extension access while logging unauthorized changes⁵.

Mitigation Strategies

For organizations using Azure Entra ID, immediate actions include:

Control Type	Implementation
Technical	Enforce Chrome ADMX policies to restrict extension installations
Monitoring	Audit `chrome.cookies` API usage and anomalous sign-ins
Architectural	Implement conditional access policies binding sessions to trusted devices

Individual users should avoid “Stay Signed In” options for critical accounts and regularly review installed extensions⁶.

Broader Implications

The attack methodology could be adapted to target AWS, Google Workspace, or Okta environments. With 35% of analyzed Chrome extensions having broad cookie-access permissions⁷, this vector presents a growing threat surface.

As Google phases out Manifest V2 extensions, organizations should inventory legacy extensions and transition to v3-compliant alternatives⁸.

Conclusion

The Cookie-Bite attack highlights fundamental weaknesses in browser-based authentication models. While temporary mitigations exist, long-term solutions require architectural changes like Device-Bound Session Cookies (DBSC) or CREAM implementation. Organizations should prioritize monitoring extension activity and consider disabling developer mode in enterprise Chrome deployments.