Procedure examples

QuasarRAT can obtain passwords from common FTP clients.

TeamPCP Cloud Stealer can harvest credentials from cryptocurrency wallets and keystores such as Ethereum keystores, Cardano keys, Solana validator keypairs, Ledger device files, and Anchor deploy keys.

iKitten collects the keychains on the system.

Cuckoo Stealer can capture files from a targeted user's keychain directory.

Green Lambert can use Keychain Services API functions to find and collect passwords, such as `SecKeychainFindInternetPassword` and `SecKeychainItemCopyAttributesAndData`.

LightSpy performs an in-memory keychain query via `SecItemCopyMatching()` then formats the retrieved data as a JSON blob for exfiltration.

BeaverTail has collected keys associated with macOS within `/Library/Keychains/login.keychain`.

GlassWorm has collected keys stored within `/Library/Keychains/login.keychain-db`.

Calisto collects Keychain storage data and copies those passwords/tokens to a file.

MacMa can dump credentials from the macOS keychain.

Proton gathers credentials in files for keychains.

Empire uses the command `/usr/bin/security dump-keychain -d` to read the keychain credential.

LaZagne can obtain credentials from macOS Keychains.

Keydnap uses the keychaindump project to read securityd memory.

TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.

Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.

Smoke Loader searches for credentials stored from web browsers.

RedLeaves can gather browser usernames and passwords.

InvisibleFerret has stolen login data, autofill data, cryptocurrency wallets, and payment information saved in web browsers such as Chrome, Brave, Opera, Yandex and Edge, to include versions affiliated with major operating systems on Windows, Linux, and macOS. InvisibleFerret has also leveraged the command `ssh_zcp` to copy browser data to include extensions and cryptocurrency wallet data.

RainyDay can use tools to collect credentials from web browsers.

NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.

OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.

CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.

MirrorStealer can steal credentials stored in browsers.

Emotet has been observed dropping browser password grabber modules.

Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.

Crimson contains a module to steal credentials from Web browsers on the victim machine.

Machete collects stored credentials from several web browsers.

A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.

TRANSLATEXT has stolen credentials stored in Chrome.

Mispadu can steal credentials from Google Chrome.

BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.

XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.

KeyBoy attempts to collect passwords from browsers.

BeaverTail has stolen passwords saved in web browsers. BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from `/.mozilla/firefox/` for exfiltration.

ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.

Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.

Lumma Stealer has gathered credential and other information from multiple browsers.

TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.

Chaes can steal login credentials and stored financial information from the browser.

GlassWorm has gathered credentials stored in Mozilla FireFox and Chromium-based Browsers.

Trojan.Karagany can steal data and credentials from browsers.

KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.

BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.

KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.

RedLine Stealer was designed to steal sensitive information from web browsers, including credit card details, saved credentials, and autocomplete data. RedLine Stealer can also gather credentials from several browsers.

Grandoreiro can steal cookie data and credentials from Google Chrome.

SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.

XLoader can gather credentials from several web browsers.

MgBot includes modules for stealing credentials from various browsers and applications, including Chrome, Opera, Firefox, Foxmail, QQBrowser, FileZilla, and WinSCP.