Non-Browser SQLite Query Against Chrome/Brave/Edge Login Data

Duo Tech@duotech

•updated Aug 21, 2026•0•0•5

Detects a non-browser process directly querying the Chrome/Brave/Edge SQLite Login Data store with the exact origin_url/username_value SELECT statements used by the botking RAT to harvest saved credentials.