> Concept · Browser Credential Harvesting_

~/packetpursuit $ cat /intel/concepts/browser-credential-harvesting.md

typeconceptconfidencehighcreated2026-06-28updated2026-06-28credential-accessdiscoverycollectionbrowser-theftinfostealer

Browser Credential Harvesting

Overview

Cross-family technique: malware reads browser credential databases from local disk to extract saved passwords, cookies, and autofill data. Targets vary by family but commonly include Chromium-based browsers (Chrome, Edge, Brave, Opera) and Gecko-based browsers (Firefox, Thunderbird).

Typical Targets

Browser Credential File Path
Chrome / Edge / Brave Login Data (SQLite) %LOCALAPPDATA%\Google\Chrome\User Data\Default\
Firefox logins.json + key4.db %APPDATA%\Mozilla\Firefox\Profiles\<profile>\
Opera Login Data %APPDATA%\Opera Software\Opera Stable\
Old Firefox signons.sqlite Same profile directory

Decryption

  • Chromium-based browsers use DPAPI (CryptProtectData) to encrypt the master key; malware running as the same user can call CryptUnprotectData without elevation.
  • Firefox uses NSS/3DES or AES-256-CBC with a key derived from key4.db.

Observed In

  • agenttesla — harvests Chrome, Edge, Firefox, Opera, Brave, UC Browser, Torch, Flock, Falkon, QQ Browser, Mozilla icecat ^[/intel/analyses/accd2ccd2be48b4303154bb87f87d0d6897441c18ca7b16b22fbaa8b68bbacbb.html]
  • acrstealer — Go-based infostealer with custom DPAPI implementation
  • maskgramstealer — wallet-seed regex + browser credential theft via Telegram exfil

ATT&CK Mapping

  • T1003 — OS Credential Dumping
  • T1555.003 — Credentials from Web Browsers

Related