CrySome RAT Browser Credential Theft via passwords.json/cookies.json in output\Default Folder

Duo Tech@duotech

•updated Jul 9, 2026•1•0•1

This rule detects processes accessing sensitive browser credential files ('passwords.json' or 'cookies.json') located in common browser profile output directories. Accessing these files is a common technique used by malware and adversaries to steal stored credentials from web browsers.