Non-Browser Process Accesses Chromium/Firefox Credential SQLite Databases

Duo Tech@duotech

•updated Jul 16, 2026•2•0•5

Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.