BQTLock Credential Harvesting — Password Staging, Browser & Vault Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects credential harvesting behavior associated with the BQTLock (BaqiyatLock) malware, including the staging of password files in temporary directories, unauthorized access to browser credential stores (e.g., Login Data, key4.db), and the use of system utilities like vaultcmd.exe to interact with the Windows Credential Manager. It also monitors the execution of PyInstaller-packed loaders (BQT.exe or start.exe) from temporary directories.