TA4922 Chromium Login Data and Cookies Access by Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects non-browser processes attempting to read sensitive files within Chromium-based browser profiles, such as 'Login Data', 'Cookies', and 'Web Data'. Such activity is highly indicative of credential theft or session token exfiltration by malicious software targeting stored browser secrets.