Infostealer - Browser Extension & Password Manager Vault File Access

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•2

This rule detects unauthorized or suspicious processes attempting to access sensitive local browser extension data or known password manager vault files (e.g., .kdbx, vault.json, data.json). This behavior is characteristic of infostealer malware or credential-harvesting activities attempting to extract stored secrets.