Laravel Stealer - DPAPI Chrome Decryptor Launch (T1555.003)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Correlates the execution of an executable initiated by cscript.exe with the subsequent access of Chrome's 'Login Data' file, indicating an attempt at offline DPAPI decryption, potentially by the Laravel Stealer malware.