PATENT PENDING · BROWSER CREDENTIAL DETECTION
Hookset plants synthetic credentials and session cookies directly inside your users' browser credential stores — Chrome, Edge, Brave, Opera and Firefox. When an attacker validates what they stole, you get a confirmed detection with exact endpoint attribution. No guesswork, no triage sprawl.
HOW IT WORKS
Hookset operates outside the malware execution chain entirely. It catches commodity infostealers that bypass EDR and only fires when there is confirmed attacker activity on the other end.
Credentials injected at the source
Synthetic passwords and session cookies are written directly into the browser's own credential stores, encrypted with the browser's own key material, in a format indistinguishable from the real thing. Every harvesting tool treats them as legitimate.
Infostealer takes the bait
When a commodity infostealer runs on the endpoint, it exfiltrates the honeytoken credentials alongside everything else. No special behavior is needed to trigger detection.
Attacker fires the alarm
The moment stolen credentials are tested against the decoy portal on the customer's own domain, a confirmed detection event fires with full endpoint attribution, a timestamp, and attacker signal. No triage required.
FEATURES
Every design decision in Hookset traces back to real infostealer behavior and IR workflow pain that most tools never address.
Honeytokens are encrypted with the browser's own key material and written directly into its own credential and cookie databases — DPAPI-wrapped AES-256-GCM for the Chromium family, NSS PBKDF2 / AES-256-CBC for Firefox — with realistic usage counts and ageing. The encrypted secret is byte-identical in format to one the browser wrote itself. Passwords use a 50/50 mix of human-believable patterns and machine-generated styles to defeat the entropy-analysis tools attacker toolkits use to flag synthetic credentials in stolen dumps.
Every honeytoken is minted for one specific endpoint. When one is replayed — from any machine, any network, any country — the detection resolves back to the exact machine it was planted on. No ambiguity, no cross-device noise.
Detection happens server-side at the point of credential validation. No security agent, service or driver monitors the endpoint — only a periodic lightweight check-in that maintains the planted tokens. Infostealers that fully evade your EDR are still caught the moment the attacker tries to use what they took.
A library of 32 keyword patterns covering the services attackers prize most: VPN gateways (Pulse, AnyConnect, GlobalProtect, Citrix), identity providers (Okta, ADFS, Azure AD, Ping, OneLogin), cloud consoles (AWS, Azure, GCP), and internal tooling — with 107 hostname variants so no two deployments look alike, all built on a per-customer lookalike domain so every credential reads like it belongs to that organization.
No SIEM rules. No behavioral thresholds. A detection requires an exact honeytoken match — anything else is logged separately and never alerts. Scanners, crawlers and background noise do not generate events. A Hookset alert means someone used a credential that only ever existed on one of your machines.
Multi-tenant architecture with database-enforced tenant isolation, per-customer dashboards, per-customer webhook and Slack/Teams alert routing, configurable endpoint retention, and a lightweight single-binary Windows deployer. Built for managed service delivery from the start.
Every detection event is scored for automation signals — header completeness, Sec-Fetch directives, Accept and Accept-Encoding quality. Scripted tooling that omits browser headers is flagged; a browser-driven session generally is not. It is a triage hint, not a classification, and it shapes IR response and feeds downstream threat intelligence.
USE CASE
This is the scenario Hookset was built to solve.
WITHOUT HOOKSET
Your IR team has to treat every machine that user touched as potentially compromised. Workstations, jump boxes, shared servers. That is 8 to 12 endpoints to analyze and remediate. Weeks of work and massive scope creep on every single incident.
WITH HOOKSET
THE THREAT
Infostealer malware is a category of commodity malware designed to do one thing: silently harvest credentials from infected endpoints and send them to attackers. No encryption, no ransom demand, no dramatic payload. It gets in, takes what it came for, and gets out. Most victims never know it happened.
What it steals is straightforward: saved passwords, active session cookies, autofill data, anything stored in your browser's credential stores. Session cookies are the highest value target. They allow an attacker to authenticate as a user without knowing their password and without triggering MFA. By the time a stolen cookie is used, the malware that took it is long gone.
The scale of the problem is not theoretical. Verizon's 2025 Data Breach Investigations Report found that 54% of ransomware victims had their domains appear in infostealer logs. Recorded Future indexed 2.95 billion compromised credentials in 2025; 276 million — 31% of everything malware-sourced — carried active session cookies. The average infected device yielded 87 stolen credentials across corporate and personal accounts.
The detection gap is where the real damage happens. Traditional security tools are built to catch malware on the endpoint. Infostealers are fast, quiet, and increasingly built to evade that layer entirely. By the time stolen credentials surface in a stealer log or get used in an attack, the window for endpoint-based detection has long closed. Security teams are left treating every machine a compromised user touched as a potential infection source, with no way to know which one actually was.
That is the problem Hookset solves.
Session cookie theft lets attackers authenticate as your users without a password and without triggering MFA. The cookie proves the session is already authenticated. The second factor already happened. Infostealers know this — stolen session data has now overtaken passwords as attackers' primary target, precisely because MFA does not stop it.
Hookset plants honeytoken session cookies that look exactly like the real thing. When one gets harvested and used, you know. That is detection at the layer attackers are actually exploiting right now.
FAQ
No. Hookset operates at the credential validation layer, which is entirely separate from endpoint detection. EDR catches malware behavior on the endpoint. Hookset catches the attacker after the malware has already done its job and the stolen credentials are being put to use. They complement each other, and Hookset specifically covers the gap where EDR falls short.
Chrome, Edge, Brave, Opera, and Firefox — all five are supported in production. Every check-in re-probes the endpoint for installed browsers. When one holding saved credentials is found without full coverage, tokens are planted on that same run — no operator action required. A freshly installed browser is picked up once the user saves their first password in it.
Via a lightweight Windows deployer that is managed centrally. It is designed for deployment across a customer's endpoint fleet without requiring interaction from end users.
Every detection event delivers a complete forensic package: the exact hostname and OS username of the compromised endpoint, a precise UTC timestamp, the source IP the connection actually came from — resolved from the trusted proxy hop so it cannot be forged by a spoofed header — the user agent string, and the specific credential or cookie that was used. Every event is scored for automation signals and carries a full HTTP header fingerprint, both available in the dashboard and CSV export. An alert email fires immediately with the endpoint, timestamp, source IP, user agent and the specific token used. What your IR team does from there is yours to run — Hookset tells you which machine to contain with certainty.
Because attackers steal both. Commodity infostealers harvest everything in a browser's credential stores indiscriminately: passwords and session cookies in the same pass. Session cookies are the higher value target for sophisticated attackers since they bypass authentication entirely without needing to know a password. Planting both means whichever surface the attacker hits fires a detection event. Redundancy is how you close gaps.
Every deployment gets its own domain and its own portal, inside the customer's network. There is no shared Hookset hostname, no common certificate issuer pattern, and no central listener for the tokens to point at. A validated credential from one customer reveals nothing about any other, and there is no single indicator an operator could blacklist across deployments.
GET IN TOUCH
Hookset is in active development and we are selectively onboarding early partners. If you run an MSSP or are a security team dealing with infostealer exposure, reach out.
