CRESCENTHARVEST - Chrome App-Bound Key Decryption Artifact

Ethan Andrews@eandrews

•updated Feb 19, 2026•4•0•37

Detects the creation of the file 'decrypted_appbound_key.txt' in the AppData\Roaming directory. This file is a specific artifact generated by the CRESCENTHARVEST malware after it successfully decrypts Chrome's app-bound encryption key, indicating browser credential compromise.