TA4922 Atlas RAT / ValleyRAT Browser Credential Store Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects non-browser processes attempting to read, create, or modify browser-specific credential storage files (e.g., 'Login Data', 'logins.json', 'signons.sqlite') associated with Chromium-based browsers or Firefox. This activity is a common indicator of credential theft by malware such as Atlas RAT or ValleyRAT.