Procedure examples

Machete retrieves the user profile data (e.g., browsers) from Chrome and Firefox browsers.

PowerLess has a browser info stealer module that can read Chrome and Edge browser database files.

Mafalda can collect the contents of the `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\LocalState` file.

Cuckoo Stealer can collect bookmarks, cookies, and history from Safari.

MobileOrder has a command to upload to its C2 server victim browser bookmarks.

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

To collect data on the host's Wi-Fi connection history, LightSpy reads the `/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist` file. It also utilizes Apple's `CWWiFiClient` API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.

BeaverTail has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.

DarkWatchman can retrieve browser history.

Lumma Stealer has identified and gathered information from two-factor authentication extensions for multiple browsers.

GlassWorm has searched browser data for cookies, history, login databases, and cryptocurrency wallets.

RedLine Stealer can collect information from browsers and browser extensions.

SUGARDUMP has collected browser bookmark and history information.

Calisto collects information on bookmarks from Google Chrome.

Troll Stealer collects information from Chromium-based browsers and Firefox such as cookies, history, downloads, and extensions.

Lizar can retrieve browser history and database files.

Dtrack can retrieve browser history.

Empire has the ability to gather browser data such as bookmarks and visited sites.