Remcos Browser Credential Theft and Cookie/Login Data Wipe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•4

Detects non-browser processes attempting to read or delete sensitive browser data files (e.g., Login Data, Cookies, Web Data, logins.json, cookies.sqlite) located in standard Windows browser paths. The rule specifically flags suspicious behavior involving file access and deletion patterns commonly associated with credential theft or 'browser-wiping' malware like Remcos.