BQTLock Browser Credential Theft via BQT.exe and bqt_passwords.txt

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects BQTLock ransomware activity where the BQT.exe process accesses browser credential stores (Chrome, Firefox, Opera) and writes the extracted data to a temporary file at C:\Windows\Temp\bqt_passwords.txt.