Cookie Bite Attack: How Session Cookies Threaten Microsoft 365 Security

If you run a major chunk of your business on Microsoft 365, you might want to put that celebratory “we passed another compliance audit” cake back in the fridge, at least until you hear about the latest episode of Authentication Drama Theatre: the “Cookie Bite” attack. This newly publicized trick revolves around Azure Entra ID (that’s Microsoft’s identity platform formerly known as Azure Active Directory, for those still rebranding their PowerPoints) and a pair of cookies named ESTSAUTH and ESTSAUTHPERSISTENT—collectively, the unsung gatekeepers to your digital kingdom.

What in the Name of Cookies Is Happening?​

Researchers at Varonis Threat Labs, champions of squashing things that go bump inside your cloud, dissected a fresh attack vector that leverages these two authentication cookies. Here’s the elevator pitch: If an attacker nabs these cookies, they can bypass fancy Multi-Factor Authentication (MFA) measures—yes, the same ones you bragged about on your last security slide—and waltz right into your Outlook, Teams, and possibly your secret company meme repository.
According to Varonis, these cookies serve as session credentials, essentially a glowing “Access Granted” stamp on the hand of whoever presents them. ESTSAUTH is the quick-pass, valid only while the browser is open. ESTSAUTHPERSISTENT, as you can guess, is like an indelible stamp that remains even after the party (browser session) ends, coming back to haunt you with every fresh login.
And here’s a tidbit every IT pro can chew on: this method doesn’t rely on some unpatched bug. No zero-day headlines, just the clever exploitation of standard session management.
Let’s pause for a moment of reflection: Isn’t it a bit poetic that the very essence of “single sign-on convenience” might now mean single sign-in for both you and “Russian-hacker-number-47”? Live by the login ease, risk dying by it, too.

The Cookie Theft: It’s Not Just for Hungry Browsers Anymore​

The Varonis proof-of-concept (PoC) showcases how attackers can automate the process of ~“borrowing”~ your session cookies:

• A custom Chrome extension quietly tracks and scoops up cookies every time you authenticate.
• PowerShell automation ensures this extension stays put—turning persistence from “optional” to “default.”
• An exfiltration routine beams the cookies off to a remote server whenever you log into Microsoft’s authentication portal.
• The attackers’ own browser gets a shiny new extension to slot these cookies in, allowing them to instantly impersonate you, skipping past MFA as if they were carrying your phone, face, and probably your coffee mug.

What’s charming (depending on your perspective) is the surgical simplicity of the entire operation. No need to drop malware, no kernel exploits, no registry mangling—just browser-level “persistence.” Many endpoint detection and response (EDR) tools are left dreaming about system-level signatures while this attack slithers by practically unnoticed.
From a cynical IT manager’s perspective: If a breach can be orchestrated with nothing but a browser plugin and a PowerShell script, maybe it’s time to stop gifting employees new browser toolbars as holiday party favors.

By the Numbers: Scope, Exposure, and a Gentle Panic​

Here’s the kicker: Any organization using Azure Entra ID—which, let’s be honest, is just about any medium-to-large company running on Microsoft 365—is a potential target. That includes everything from hedge funds to Hollywood talent agencies, all the way down to the local council that thinks Teams is just a “fancy Skype.”
Imagine realizing that your relentless rollout of MFA, risk-based sign-in, and “user-awareness” quizzes can be sidelined by a clever cookie caper. Azure Entra ID has long been the lynchpin for securing access in cloud-centric environments, but “Cookie Bite” underscores a flaw in session management, not just with Entra but arguably in modern web security’s reliance on browser-stored tokens.
Let’s pour one out for those heroically long “security hardening” checklists that forgot to include: “Trust no cookie, delete all cookies, consider going gluten-free.”

The “Cookie Bite” Attack Flow: A Four-Step Munch​

If you’re hungry for technical depth (and who isn’t?), here’s how it goes down:

• Monitor Authentication Events: The attacker’s Chrome extension silently watches your sign-in attempts.
• Steal and Persist Cookies: Cunning scripts extract both transient (ESTSAUTH) and persistent (ESTSAUTHPERSISTENT) cookies.
• Exfiltrate Cookies to Remote Server: Each login sees a digital doggy bag of your session credentials sent off-campus.
• Inject Cookies for Hijacked Sessions: The attacker, equipped with a matching browser extension, plants the extracted cookies and slips into your account. MFA? Already satisfied—by you—moments earlier.

Let’s just say: If only persistent browser extensions worked this seamlessly for legitimate business uses, more IT projects might finish on time.

MFA Bypass: When Layered Security Meets a Butter Knife​

One of the scarier implications here is the bypass of MFA. Organizations have funneled time, money, and the patience of their employees into layered authentication. We all know the litany: “Even if a bad actor compromises your password, MFA still stands guard!” In practice, session cookies are living proof MFA efficacy lapses once you’re in—and losing those cookies means handing over “already authenticated” tokens.
As attackers inject these cookies, they’re not forcing a brute entry. They’re picking up your security badge from the staff room while you’re grabbing that second coffee.

The Real-World Prize: Persistence, Lateral Movement, and Stealth​

Attackers with hijacked sessions don’t just prance around on Outlook. They can:

• Remain undetected as they explore your network, posing as regular, trusted users.
• Escalate privileges, planting deeper hooks for further exploitation.
• Exfiltrate gigabytes of precious data with all the subtlety of a ninja in socks.
• Set up cryptominers or launch additional attacks, all from a beach in “Parts Unknown.”

And since these actions are taken by accounts that look and behave just like your trusted users, detecting malice becomes much, much harder. Your SIEM (Security Information and Event Management, not “Really Tired Admin” in reverse) now needs to be sharp-eyed for subtle behavioral anomalies, not just Burp Suite’s “Obvious Intruder Detected!” banners.
When infosec people say, “attackers only need to be lucky once, defenders have to be lucky all the time,” they’re thinking about attacks exactly like this. Or possibly about their hopes in the lottery—same odds, it sometimes feels.

“This Isn’t a Vulnerability—It’s Just the Way Things Work”​

Perhaps the most unsettling twist in the Cookie Bite story is that this isn’t a zero-day. Varonis went out of its way to clarify that they didn’t alert Microsoft—because there’s no specific vulnerability being exploited. Session cookies have always fulfilled this function, and browsers, bless their user-friendly hearts, store them precisely so that “the user experience” is seamless.
This isn’t a case of Microsoft’s developers sleeping at the wheel (unless you count letting an authentication cookie out of the house without a chaperone). It’s a whole class of security risk tied deeply to how modern web applications work. If anything, this should be a wake-up call to every cloud-centric admin who’s relied on “default” security settings.
Sometimes, the default isn’t your friend—especially when your friend keeps spilling the cookies.

Notable Strengths (And Weaknesses) of “Cookie Bite” as an Attack Vector​

Let’s be fair, tech journalism isn’t all doom-and-gloom. Here’s what Cookie Bite does well, and where defenders can still find hope:
Strengths:

• Ridiculously accessible: Browser extensions and scripts, not high-end exploits.
• Low detection footprint: No system-wide malware signatures to trigger EDR or antivirus solutions.
• MFA defeatist: Takes advantage of authenticated sessions rather than credential theft.
• Persistent access: Especially via the “persistent cookie” (ESTSAUTHPERSISTENT), which remains through browser restarts.

Weaknesses:

• Requires local compromise: An attacker must persuade the victim to install a browser extension or get code running in their session.
• Impact can be mitigated: Techniques like trusted browser extension allowlists, close session review, and advanced identity protection solutions drastically raise the bar for attackers.

Still, if “getting someone to install a helpful-sounding browser extension” sounds improbable, remember half your office already has a Chrome dark mode, a price tracker, or a mysterious calculator.

Playing Defense: What’s Actually Effective?​

Mark Vaitsman of Varonis didn’t just wave a red flag—he handed over some practical defense tips:

• Use Microsoft’s Risk Detection for Sign-Ins. The Microsoft Risk engine can flag unusual behavior, such as new device or location logins, which may signal an attacker injecting cookies for access.
• In-Browser Protections. Implement Chrome ADMX policies to allow only trusted extensions. (Raise your hand if your IT team uses Group Policy like a blunt instrument! Here’s where precision pays.)
• Continuous Monitoring. Anomaly detection—like watching for impossible travel scenarios or session reuse oddities—can surface surreptitious cookie abusers.
• User Awareness (Not Just for Posters). Frequent reminders that “suspicious browser extensions” are bad for health, company, and sleep.

And, as Vaitsman laments (join him in his tears, reader), precious few organizations actually restrict which browser extensions users can install. We’re not saying you need a Browser Extension Czar, but maybe it’s time for a memo?

Broader Implications: When Cloud Convenience Collides with Security Reality​

If this entire saga teaches anything, it’s the balancing act that is modern cloud security. We want seamless logins and one-click access, but these often depend on session tokens and browser-stored artifacts—the very mechanisms that Cookie Bite manipulates.
Organizations pouring effort into Zero Trust frameworks must now also question: How much trust are we shoveling into browsers and users’ hands with minimal oversight? Cookie management, extension control, identity anomaly detection—these aren’t “nice-to-haves.” They’re becoming core competencies for anyone serious about security.
A harsh takeaway: Adopting shiny cloud services doesn’t lessen the need for foundational hygiene. It just moves the dirt around.

In Closing: Cookie Monster’s Digital Renaissance​

Cookie Bite is both a technical achievement (from the attackers’ angle) and a foreboding sign for cloud security practitioners. And let’s be honest—nobody wants to tell their board they got “side-swiped by cookies.” Yet here we are, in the golden age of web convenience, facing hard lessons about session persistence and browser extension risk.
If there’s one thing to keep you up at night (besides Teams notifications), let it be the humble cookie. Not all treats are sweet—especially when they’re handing your org’s keys to strangers.

---

Source: Dark Reading https://www.darkreading.com/remote-workforce/cookie-bite-entra-id-attack-exposes-microsoft-365/