PostCSS RAT abdrizak - Chrome Credential Theft and File Artifacts

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•8

Detects file artifacts produced by the PostCSS typosquatting Windows RAT (abdrizak). Covers Chrome credential dump outputs (pwd.txt, chrome_logins_dump.txt), access to Chrome Login Data and Local State files by non-browser processes, and single-instance tracking files (.store, .host) written to the TEMP directory.