TokenGrabber Stealer: Firefox places.sqlite/cookies.sqlite Access

Ankit Mehta@Secvyn

•updated 8 days ago•0•0•0

Detects unauthorized processes (excluding firefox.exe and explorer.exe) accessing or modifying sensitive Firefox browser profile files, specifically places.sqlite (history/bookmarks) and cookies.sqlite (session cookies). This activity is often indicative of credential or session hijacking attempts by malware or malicious scripts.