Umbrij BackupFiles staging directory for browser credential theft

Ethan Andrews@eandrews

•updated Jul 2, 2026•0•0•2

Detects the creation of a 'BackupFiles' directory and the subsequent copying of sensitive browser artifacts (e.g., Login Data, Web Data, Local Storage) within Chrome or Edge user data paths. This activity is indicative of credential and session theft staging, specifically associated with the ToddyCat group's Umbrij malware preparation for browser exploitation.