Procedure examples

During the SolarWinds Compromise, APT29 stole users' saved passwords from Chrome.

APT3 has used tools to dump passwords from browsers.

Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.

Volt Typhoon has targeted network administrator browser data including browsing history and stored credentials.

Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.

APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores.

MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.

FIN6 has used the Stealer One credential stealer to target web browsers.

Leafminer used several tools for retrieving login and password information, including LaZagne.

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.

ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.

APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.

TA505 has used malware to gather credentials from Internet Explorer.

RedCurl used LaZagne to obtain passwords from web browsers.

Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.

Malteiro has stolen credentials stored in the victim’s browsers via software tool NirSoft WebBrowserPassView.

APT42 has used custom malware to steal credentials.

LAPSUS$ has obtained passwords and session tokens with the use of the Redline password stealer.

Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.

Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.

HEXANE has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.

Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.

Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.

Smoke Loader searches for credentials stored from web browsers.

RedLeaves can gather browser usernames and passwords.

InvisibleFerret has stolen login data, autofill data, cryptocurrency wallets, and payment information saved in web browsers such as Chrome, Brave, Opera, Yandex and Edge, to include versions affiliated with major operating systems on Windows, Linux, and macOS. InvisibleFerret has also leveraged the command `ssh_zcp` to copy browser data to include extensions and cryptocurrency wallet data.

RainyDay can use tools to collect credentials from web browsers.

NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.

OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.

CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.

MirrorStealer can steal credentials stored in browsers.

Emotet has been observed dropping browser password grabber modules.

Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.

Crimson contains a module to steal credentials from Web browsers on the victim machine.

Machete collects stored credentials from several web browsers.

A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.

TRANSLATEXT has stolen credentials stored in Chrome.

Mispadu can steal credentials from Google Chrome.

BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.

XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.

KeyBoy attempts to collect passwords from browsers.

BeaverTail has stolen passwords saved in web browsers. BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from `/.mozilla/firefox/` for exfiltration.

ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.

Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.

Lumma Stealer has gathered credential and other information from multiple browsers.

TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.

Chaes can steal login credentials and stored financial information from the browser.