UnregStealer - Browser Fetching Whitelist Extension

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

Tracks browser network events where chrome.exe or msedge.exe are fetching a dynamic extension script named 'whitelist.extension.txt'. This activity is associated with the UnregStealer malware, which is known for human-operated browser credential theft.