TONResolver RAT: Non-Browser Process Accessing Browser Cookie/Credential Stores

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where processes not associated with standard web browsers (e.g., node.exe) attempt to create, modify, or rename browser-related sensitive files, specifically cookie databases and DPAPI-protected Local State files. Such activity is often indicative of credential and session cookie theft.