Browser Credential Store Access After FortiClient VPN Logon (LummaC2/Stealer Browser Credential Harvesting Post-VPN Compromise)

Kaung Khant Ko@kaungkhantko

•updated Jun 23, 2026•5•0•12

Detects suspicious access to browser credential stores (Google Chrome, Microsoft Edge, Mozilla Firefox, Brave) by non-browser processes within a short time frame (2 hours) after a FortiClient VPN logon event. This activity is consistent with information stealer malware, such as LummaC2, Phantom Stealer, Aurora Stealer, Luca Stealer, and Formbook, often observed in post-compromise phases of campaigns like FortiBleed.