{
  "family": "browserpwdstealer",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan-PSW:Win32/Browserpwdstealer (Browser Password Stealer) is a generic classification for infostealers dedicated to a single, high-yield task: extracting credentials saved directly within web browsers (Chrome, Edge, Firefox, etc.). Because modern users rely heavily on browser-based password managers for convenience, these stealers are highly effective at harvesting credentials for banks, social media, and corporate portals in seconds (`T1555.003`).<br><br><b>Understanding Browser Password Stealers</b><br>To an end-user, the infection is usually invisible; the theft occurs silently in the background. For a SOC analyst, detecting a Browserpwdstealer is a 'Code Red' incident. It must be assumed that *every* password the user allowed their browser to remember is now in the hands of the attacker, requiring immediate, widespread remediation.<br><br><b>Execution and Theft Mechanics</b><br>These stealers are typically dropped by other malware (like initial access brokers or macro-enabled documents). Upon execution, they do not need advanced privileges. They simply navigate to the known local application data paths for popular browsers (e.g., `%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Login Data`). They query the local SQLite databases (`T1005`) where the passwords are stored. To decrypt the passwords, they abuse legitimate Windows APIs like `CryptUnprotectData` (DPAPI) (`T1555.003`), bypassing the need for a master password. The decrypted credentials are then formatted into a text file or JSON object and exfiltrated to the C2 server.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of the user's online identity and access. Host-based IoCs include EDR alerts for anomalous, non-browser processes attempting to read the browser's `Login Data` or `Cookies` files, and suspicious calls to `CryptUnprotectData`. Network IoCs include a short burst of outbound HTTP/HTTPS or FTP traffic immediately following execution, as the stolen credential file is uploaded.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1048",
    "T1005",
    "T1555.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers (The primary objective)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1005",
      "name": "Data from Local System (Accessing local SQLite databases)",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol (Uploading the stolen credentials)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately isolate the machine and assume all saved web credentials have been stolen.",
    "Initiate a forced password reset for *all* corporate accounts the user possessed, prioritizing VPN, email, and SSO portals.",
    "Instruct the user to reset all personal passwords (banking, social media) from a known-clean device, starting with their primary email account.",
    "Ensure Multi-Factor Authentication (MFA) is strictly enforced across all critical applications to mitigate the use of stolen passwords."
  ],
  "what_to_avoid": [
    "Do not allow the user back onto the network until their primary credentials have been rotated.",
    "Avoid letting users store sensitive corporate passwords in their browser's built-in password manager; utilize a dedicated, enterprise-grade password vault."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}