InvisibleFerret Decrypts Browser Secrets with DPAPI via Python

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

Detects Python processes attempting to decrypt browser credential databases using DPAPI or CryptUnprotectData. This behavior is characteristic of malware like InvisibleFerret, which targets stored browser credentials.