Procedure examples

APT3 has used tools to dump passwords from browsers.

Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.

Volt Typhoon has targeted network administrator browser data including browsing history and stored credentials.

Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.

APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores.

MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.

FIN6 has used the Stealer One credential stealer to target web browsers.

Leafminer used several tools for retrieving login and password information, including LaZagne.

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.

ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.

APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.

TA505 has used malware to gather credentials from Internet Explorer.

RedCurl used LaZagne to obtain passwords from web browsers.

Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.

Malteiro has stolen credentials stored in the victim’s browsers via software tool NirSoft WebBrowserPassView.

APT42 has used custom malware to steal credentials.

LAPSUS$ has obtained passwords and session tokens with the use of the Redline password stealer.

Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.

Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.

HEXANE has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.

Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.