BQTLock Discord Webhook Credential Exfiltration from Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where a non-standard browser process accesses sensitive browser credential files (e.g., Login Data, Cookies, key4.db) and simultaneously establishes a network connection to Discord or transmits data to a Discord webhook. This pattern is consistent with infostealer malware attempting to exfiltrate cached credentials via external services.