Vidar - Mass Browser Database Access (T1555.003)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•5

Detects a process rapidly accessing multiple target credential stores (Login Data, Cookies, Web Data, places.sqlite) within a short time frame (1 minute). This behavior is indicative of credential stealer malware like Vidar attempting to exfiltrate sensitive browser data.