Toddycat Powershell Browser Credential Theft

Tim Peck@timpeck

•updated Nov 21, 2025•4•1•100

Detects a potential ToddyCat APT technique where a single source remotely accesses sensitive browser or DPAPI credential files on multiple hosts via SMB. This behavior is consistent with the group's TomBerBil PowerShell script used for widespread credential harvesting.