BQTLock Browser Credential Harvesting with Outbound C2 Correlation (T1555.003)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects unauthorized processes (excluding known web browsers and system processes) attempting to access sensitive browser credential files (e.g., Login Data, key4.db) followed by a network connection to external IP addresses. This behavior is highly indicative of credential theft and subsequent exfiltration.