CoolClient backdoor Browser Credential Access or Staging by Non-Browser Process

Kaung Khant Ko@kaungkhantko

•updated Jan 27, 2026•51•2•370

This rule detects suspicious activity related to browser credential theft or staging. It triggers when a non-browser process accesses sensitive browser files (like 'Login Data' or 'Local State') or when temporary artifacts associated with credential stealer activity ('chromeTmp', 'Local State-journal') are created. This behavior is indicative of an attacker attempting to exfiltrate browser-stored credentials.