{
  "family": "chromepass",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Chromepass is a highly specific utility categorized as a Credential Dumper. While it can technically be used legitimately to recover forgotten passwords, it is overwhelmingly utilized by threat actors, embedded within larger info-stealer malware, or executed during hands-on-keyboard attacks to systematically extract all saved passwords from the Google Chrome web browser.<br><br><b>Understanding Chromepass (Credential Dumping)</b><br>To an end-user, this tool operates silently; they will not know their passwords have been stolen until their accounts are compromised. For a SOC analyst, the execution of Chromepass is a severe incident indicating that an attacker has gained execution privileges on the endpoint and is actively harvesting credentials (`T1003.001`) to facilitate lateral movement or data theft.<br><br><b>Execution and Extraction Mechanics</b><br>Google Chrome stores saved usernames and passwords in a local SQLite database file (typically located at `%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Login Data`). The passwords within this database are encrypted using the Windows Data Protection API (DPAPI), which ties the encryption key to the currently logged-in Windows user's credentials. Chromepass operates by programmaticly interacting with the DPAPI (`T1555.003`). Because the attacker executes Chromepass within the context of the logged-in user, the tool simply requests Windows to decrypt the database. It then parses the SQLite file and outputs a cleartext list of URLs, usernames, and passwords.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of all web credentials saved in the user's browser, potentially leading to unauthorized access to corporate SSO portals, email, and financial accounts. Host-based IoCs include EDR alerts for 'Suspicious Credential Dumping Activity' or processes attempting to unexpectedly read the `Login Data` SQLite file. Command-line logging (Event ID 4688) may capture the execution of known Chromepass binaries or PowerShell scripts interacting with the `CryptUnprotectData` API.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1059.001",
    "T1003.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers (Targeting Chrome's Login Data)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory (Often used in conjunction to bypass DPAPI protections)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Execution method)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Mandate an immediate password reset for the compromised user, covering ALL corporate accounts and services they access.",
    "Force a session token revocation for the user across all SaaS applications and internal portals (e.g., Microsoft 365, Okta, VPN).",
    "Isolate the endpoint to prevent the extracted credentials from being used for immediate lateral movement.",
    "Analyze EDR telemetry to determine how Chromepass was executed (e.g., dropped by an info-stealer, or run manually via a reverse shell)."
  ],
  "what_to_avoid": [
    "Do not assume only the 'work' passwords were stolen; attackers will use personal credentials to access bank accounts and personal email.",
    "Avoid relying solely on file hashes to detect this tool; the extraction logic can easily be compiled into custom, evasive scripts."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}