Browserpassview

Overview

HackTool:Win32/Browserpassview is a heuristic detection for a specific utility created by NirSoft (BrowserPassView.exe). While legitimately created for system administrators to recover lost passwords, in the context of enterprise security, this tool is overwhelmingly abused by threat actors and malware as a highly effective credential dumping utility (`T1003.001`). It is designed to instantly extract saved passwords, usernames, and URLs from all major web browsers installed on a system.

Understanding Browserpassview (Credential Stealing)
To an end-user, the execution of this tool is entirely invisible. For a security operations center (SOC), the detection of Browserpassview is a critical alert indicating a severe credential compromise. Threat actors drop this tool via initial access trojans or deploy it during lateral movement to rapidly harvest saved corporate passwords, VPN credentials, and personal accounts.

Execution and Extraction Mechanics
Attackers typically deploy Browserpassview via command-line execution (`T1059.003`), often passing specific arguments to force the tool to silently dump the extracted credentials directly into a text file (e.g., `browserpassview.exe /stext c:\temp\passwords.txt`). The tool works by directly accessing the internal databases and credential stores used by Chrome (SQLite databases encrypted with DPAPI), Firefox (key3.db/logins.json), Edge, and Opera. By running under the context of the logged-in user, it utilizes the Windows Data Protection API (DPAPI) to seamlessly decrypt the stored passwords without requiring any interaction (`T1555.003`). The resulting text file is then quickly exfiltrated by the attacker.

Indicators of Compromise & Impact
The impact is the immediate, total compromise of all credentials saved in the user's web browsers, leading to massive lateral movement and data theft. Host-based IoCs include EDR alerts for the execution of the `browserpassview.exe` binary, or similarly named files, often spawned by an unauthorized process (like a macro-enabled Word document or a PowerShell script). A highly specific IoC is the command-line execution containing arguments like `/stext`, `/shtml`, or `/sxml` pointing to a temporary directory. File integrity monitoring may detect the sudden creation of plaintext files containing lists of URLs and passwords.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003.001: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BROWSERPASSVIEW {
    meta:
        description = "Detects Browserpassview (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "browserpassview" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Browserpassview Activity
id: c22397c5db3d9404d593a8da624bd904
status: experimental
description: Detects generic indicators of the browserpassview malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*browserpassview*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint; assume all credentials stored in the user's browsers (including corporate SSO, VPN, and personal accounts) are fully compromised.
2. Initiate an emergency, mandatory password reset for the affected user across all corporate systems and services.
3. Analyze EDR telemetry to trace the parent process that launched the tool to identify the initial access vector (e.g., a phishing payload).
4. Review network logs (Proxy/DNS) to identify where the dumped credential file was exfiltrated (e.g., FTP upload or HTTP POST).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack stopped with browser credentials; attackers almost always deploy additional tools to dump LSASS (Mimikatz) concurrently.
2. Avoid allowing users to save corporate passwords in web browsers; enforce the use of enterprise-managed, encrypted password managers.

References & External Analysis

• Search "browserpassview" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Jacksbot
• Banbra
• Bindjpg
• Apost
• Redator

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/browserpassview.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.