easy-day-js protocal.cjs browser extension and credential theft via node.exe

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•3

Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.