TOKYOCORE Browser Credential/Cookie Harvesting via Login Data and store.json.mozlz4 Access
Detects unauthorized processes attempting to access sensitive browser files containing credentials (e.g., 'Login Data', 'logins.json') and cookies (e.g., 'store.json.mozlz4', 'Browser_Cookies.json'). This behavior is commonly associated with credential harvesting malware such as TOKYOCORE, which seeks to steal stored browser secrets before they can be encrypted or for immediate use in session hijacking.
Cortex XDR
