StealC Browser Credential Harvest via ClickFix PowerShell Delivery

Ibrahim Saud@tektrix

•updated Jul 3, 2026•29•0•46

This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.