System and a method to detect browser session token theft using decoy tokens and decoy token site network

A method for detecting browser session token theft, comprising:

• generating decoy session tokens by deploying a web-based application at a client device;
• injecting and storing the generated decoy session tokens in a browser through a browser extension at the client device;
• collecting telemetry data from the browser to identify potential theft of session tokens;
• monitoring a network of decoy sites for unauthorized attempts to use the decoy session tokens at the network of decoy sites;
• triggering alerts when unauthorized use of a decoy session token is detected on the decoy site network, wherein the alerts comprise detailed information of the unauthorized use further including a mapping of the deployed session token corresponding to the unauthorized use with the original and legitimate session tokens active at the client device;
• wherein, the detection of the browser session token theft including detecting the deployed session token corresponding to the unauthorized use is real time and does not extend to the initial theft of legitimate session tokens, which are, instead, identified through further analysis and correlation with the telemetry data.

A system, comprising:

• a server module that generates and manages decoy session tokens;
• a web-based application at a client device that injects and stores the decoy session tokens in a browser extension in the client device and collects telemetry data from a user's browser at the client device;
• a network of decoy websites that mimics legitimate services to detect unauthorized use of legitimate session tokens;
• an analytics module that identifies and logs unauthorized attempts to use the generated decoy session tokens;
• a notification system that issues alerts upon detecting unauthorized use of the decoy session tokens, enabling rapid response.