Microsoft Details Cookie-Controlled PHP Web Shells Persisting via Cron on Linux Servers

Microsoft Defender Security Research Team details PHP-based web shells on Linux servers that use HTTP cookies as a stealthy command-and-control channel.

• •Attackers use the $_COOKIE superglobal to pass instructions, keeping malicious code dormant during normal traffic and activating only when specific cookie values are present
• •Three implementations identified: a multi-layer obfuscated PHP loader, a segmented cookie data script that reconstructs file handling functions, and a single-cookie marker script for file upload and code execution
• •A "self-healing" persistence mechanism uses cron jobs to periodically recreate the PHP loader even after it has been removed during remediation
• •Cookie-based gating separates persistence from execution control, reducing observable indicators in routine application logs