BQTLock BQT.exe Browser Credential Harvesting via Chrome/Firefox/Opera

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the BQT.exe (BQTLock ransomware) process attempting to access web browser credential files (Chrome, Firefox, Opera) or creating a password staging file in the Windows Temp directory. This behavior is indicative of credential theft performed by the ransomware prior to or during the encryption process.