Tricking the thieves: Turning [session] tokens into [Canary]tokens#

Jacob Torrey (Thinkst Applied Research)

• Why: MFA adoption has pushed attackers to session theft (AiTM phishing, infostealers) — this is the defensive countermove on the exact session/token battleground your identity roadmap cares about.
• What: Session-cookie Canarytokens: tokens that look 100% real but alert when a thief uses them and yield only a fake account. Covers which platforms can be supported, scaling architecture, and three novel deployment mechanisms: injecting into Chrome's SQLite cookie DB, a custom extension populating the in-memory cookie store, and a thin filesystem filter that redirects all non-browser reads of the browser profile to decoy data — so infostealers grab bait while normal browsing is unaffected.
• How: Thinkst Canarytoken infrastructure plus deceptive cookie storage on the endpoint; the FS-filter trick exploits the fact that stealer malware reads cookie stores differently than the browser does.
• Where applicable: Windows/Chrome-centric endpoints today (the deployment mechanisms described are browser-DB-specific); targets M365, GitHub, Google session theft. Endpoint-side control required — pairs with, not replaces, token binding/short session lifetimes. (from abstract only)