WARMCOOKIE Resurfaces After Takedown: New Variant Adds Stealth Handlers, Uses Expired C2 Certificates

WARMCOOKIE has resurfaced with a new variant that adds stealth handlers and uses expired C2 certificates, according to Elastic Security Labs. The analysis notes the malware is still being deployed through malvertising and spam campaigns, despite Europol’s Operation Endgame disrupting parts of its infrastructure in May 2025. Since its first detailing in summer 2024, Elastic reports that WARMCOOKIE has evolved from isolated phishing lures to a broader MaaS ecosystem, expanding its delivery and persistence mechanisms.

The new variant introduces four additional command handlers capable of launching executables, DLLs, and PowerShell scripts, and it can execute PE files and DLLs, including via the Start export. To evade defence, the campaign now uses string banks—lists of legitimate company names—for folder paths and scheduled task names, and it randomly selects company names at runtime.

The report also highlights the reuse of an expired SSL certificate across C2 infrastructure, suggesting a default certificate used for the back-end, which remains in use despite being expired.