Amatera - Browser Credential Store Access

Georg Lauenstein@gsec

•updated yesterday•0•0•1

Detects process command lines referencing browser credential store filenames such as Chromium "Login Data"/Cookies and Firefox logins.json/key4.db/cookies.sqlite. Amatera and similar infostealers copy or read these files to harvest saved passwords and session cookies for account takeover.