Non-browser process reading browser credential databases (infostealer)

ills3c Intel&Coffee@Ills3C

•updated 3 days ago•13•0•125

Detects non-browser, user-writable or temporary path processes interacting with web browser credential, cookie, or session data files (e.g., Login Data, Cookies, logins.json, key4.db), which is a common technique used by credential stealers.