Non-browser process accessing Chrome/Edge/Firefox Login Data or Cookies stores

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•5

Detects unauthorized access to web browser credential stores (e.g., Login Data, Cookies) by non-browser processes, such as scripting engines (PowerShell, WScript) or common LOLBins (MSBuild, InstallUtil). This behavior is indicative of credential theft or data exfiltration attempts by malicious software, including stealers like PureLog.