BabylonRAT browser kill + Chrome/Firefox Login Data access

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•2

Detects instances where browser processes or related credential files are accessed or targeted by process termination (e.g., taskkill.exe) followed by attempts to access sensitive files like Login Data, logins.json, or key4.db. This pattern is indicative of credential theft from web browsers.