BirdCall Enumerates Browser Credential Databases

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•1

Detects a non-browser process searching for Chromium Login Data, Cookies, Local State, or Firefox logins and key databases. This activity is indicative of credential access attempts where an attacker tries to extract sensitive information stored by web browsers.