Procedure examples

TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.

Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.

Smoke Loader searches for credentials stored from web browsers.

RedLeaves can gather browser usernames and passwords.

InvisibleFerret has stolen login data, autofill data, cryptocurrency wallets, and payment information saved in web browsers such as Chrome, Brave, Opera, Yandex and Edge, to include versions affiliated with major operating systems on Windows, Linux, and macOS. InvisibleFerret has also leveraged the command `ssh_zcp` to copy browser data to include extensions and cryptocurrency wallet data.

RainyDay can use tools to collect credentials from web browsers.

NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.

OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.

CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.

MirrorStealer can steal credentials stored in browsers.

Emotet has been observed dropping browser password grabber modules.

Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.

Crimson contains a module to steal credentials from Web browsers on the victim machine.

Machete collects stored credentials from several web browsers.

A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.

TRANSLATEXT has stolen credentials stored in Chrome.

Mispadu can steal credentials from Google Chrome.

BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.

XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.

KeyBoy attempts to collect passwords from browsers.

BeaverTail has stolen passwords saved in web browsers. BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from `/.mozilla/firefox/` for exfiltration.

ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.

Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.

Lumma Stealer has gathered credential and other information from multiple browsers.

TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.

Chaes can steal login credentials and stored financial information from the browser.

GlassWorm has gathered credentials stored in Mozilla FireFox and Chromium-based Browsers.

Trojan.Karagany can steal data and credentials from browsers.

KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.

BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.

KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.

RedLine Stealer was designed to steal sensitive information from web browsers, including credit card details, saved credentials, and autocomplete data. RedLine Stealer can also gather credentials from several browsers.

Grandoreiro can steal cookie data and credentials from Google Chrome.

SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.

XLoader can gather credentials from several web browsers.

MgBot includes modules for stealing credentials from various browsers and applications, including Chrome, Opera, Firefox, Foxmail, QQBrowser, FileZilla, and WinSCP.

Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.

Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer.

PLEAD can harvest saved credentials from browsers such as Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox.

Raccoon Stealer collects passwords, cookies, and autocomplete information from various popular web browsers.

Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.

Proton gathers credentials for Google Chrome.

Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.

PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.

Melcoz has the ability to steal credentials from web browsers.

njRAT has a module that steals passwords saved in victim web browsers.

ChChes steals credentials stored inside Internet Explorer.

Manjusaka gathers credentials from Chromium-based browsers.

Agent Tesla can gather credentials from a number of browsers.