> Technique · Email Harvesting via CDP Browser Automation_

~/packetpursuit $ cat /intel/techniques/email-harvesting-via-cdp.md

typetechniqueconfidencehighcreated2026-08-08updated2026-08-08cdpbrowser-manipulationemail-harvestingcollectiondotnet

email-harvesting-via-cdp

Use of Chrome DevTools Protocol (CDP) to silently navigate to webmail services (Outlook Web, Gmail) and instant messaging web apps (WhatsApp Web), extract contact lists, and relay outbound messages through the victim's authenticated session. The browser is launched in a hidden or minimized state and driven via CDP JSON-over-WebSocket commands.

Technique Details

  • Outlook Web: ExecuteOutlookWeb, HarvestOutlookWebContacts, ConnectOutlookTab ^[strings.txt]
  • Gmail: ExecuteGmailWeb, HarvestGmailContacts, ConnectGmailTab, HarvestFromGmailTab ^[strings.txt]
  • WhatsApp Web: ExecuteWhatsAppCdp, RunWhatsAppHarvest, WaitForWhatsAppReady, CountWhatsAppCookies ^[strings.txt]
  • Token extraction: ExtractGraphToken, ExtractOutlookWebToken for Microsoft Graph API abuse ^[strings.txt]

Cross-References