Non-Firefox Process Loading nss3.dll/mozglue.dll (Credential Decryption)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects instances where a process other than the legitimate Firefox browser executable loads the NSS (Network Security Services) libraries nss3.dll or mozglue.dll from the Firefox installation directory. This behavior is indicative of unauthorized attempts to decrypt saved browser credentials by interacting with Firefox-specific security modules, a technique commonly used by credential-stealing malware.