Browser Data Theft by Non-Browsers (T1555.003)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Detects attempts by non-browser processes like Python, Node.js, CScript, or WScript to access browser-related SQLite database files such as 'Login Data', 'Cookies', or 'Web Data'. This activity is indicative of credential access or data exfiltration.