Topic starter
11/11/2026 6:02 pm
TL;DR: 15,101 credential entries across four industrial remote access platforms showed that stolen browser profiles can carry both passwords and the session URLs that identify specific machines, accounts and ports, according to Flare's telemetry and case work. For operators, the address bar can become part of the identity boundary, not just a navigation field.
Editorial analysis by NHI Mgmt Group, based on content published by Flare: “Measuring Credential Exposure of Contractors and Integrators After the Refrigeration System Attack in France: 601 Industrial Remote Access Addresses Recovered From Stealer Logs, 73% on the Largest Platform Paired With Device Credentials”.
By the numbers:
- 374 of 511 tunnel addresses appeared in the same stolen record as a device credential.
- Of 2,032 usernames stored against those addresses, 1,952 were administrative.
- The median interval between first and last observation was 51 days for addresses seen more than once.
Key questions
Q: Why do descriptive tunnel URLs increase remote access risk?
A: Descriptive tunnel URLs make remote access easier to discover, recognise and reuse by anyone who sees logs, emails or browser history.
Q: How should teams govern third-party industrial access routes?
A: Third-party industrial access routes should be governed as supplier accounts with named ownership, least-privilege entitlements, MFA, approval workflows, logging and periodic recertification.
Q: How do stolen browser profiles expose industrial remote access sessions?
A: Stolen browser profiles can expose saved login state, session cookies, autofill data and bookmarked remote access portals, letting an attacker resume an industrial session without the password.
Practitioner guidance
- Harden browser recovery paths for remote access sessions Disable unnecessary session restore, history retention and profile sync on engineering endpoints that use browser-based industrial access portals.
- Minimise identity details in tunnel URLs Remove customer names, machine labels, forwarded protocol values and internal addresses from any access path that can be stored or copied.
- Separate administrative reach from discoverable routes Ensure elevated device credentials are not recoverable from the same browser state that stores the tunnel URL and portal session.
Bottom line: Industrial remote access can leak more than passwords because the browser may preserve a usable route to the target machine.
Glossary terms: Industrial Secure Remote Access, Session URL, Browser Profile Theft, Infostealer
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Remote access URLs have become identity-bearing artifacts, not just navigation data. In this class of platform, the browser record can preserve the session route, the customer context and the forwarded service details alongside the credential itself. That means a stolen profile can carry enough context to collapse the attacker’s discovery work before any login attempt begins. The practitioner implication is that browser-stored access metadata now belongs in identity governance, not only in endpoint hygiene.
A question worth separating out:
Q: What is the difference between a password and a session URL in remote access?
A: A password proves a user knows a secret, while a session URL can point directly to an active or pre-authenticated remote access session. If the URL is copied, logged or forwarded, it may function like a bearer link and bypass normal login checks until it expires or is invalidated. Use short-lived sessions, token binding and strict revocation controls.
👉 Read our full editorial: Stolen browser profiles can expose industrial remote access routes