Python Infostealer Reading Browser Credential DBs and Exfiltrating to Telegram or HTTP C2

Ibrahim Saud@tektrix

•updated Jun 25, 2026•2•0•3

Detects Python scripts or processes accessing common browser credential and cookie storage files (such as Login Data, key4.db, or cookies.sqlite) and subsequently making outbound network connections, indicating potential theft and exfiltration of browser data.