Non-browser process accessing browser cookie/session storage files

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

Detects instances where a process not associated with standard web browsers accesses, copies, or modifies sensitive browser files such as cookies, local storage, or session tokens. This behavior is highly indicative of information-stealer malware (e.g., Vidar, Lumma, RedLine) attempting to exfiltrate session data for account hijacking.