Browserpwdstealer

Overview

Trojan-PSW:Win32/Browserpwdstealer (Browser Password Stealer) is a generic classification for infostealers dedicated to a single, high-yield task: extracting credentials saved directly within web browsers (Chrome, Edge, Firefox, etc.). Because modern users rely heavily on browser-based password managers for convenience, these stealers are highly effective at harvesting credentials for banks, social media, and corporate portals in seconds (`T1555.003`).

Understanding Browser Password Stealers
To an end-user, the infection is usually invisible; the theft occurs silently in the background. For a SOC analyst, detecting a Browserpwdstealer is a 'Code Red' incident. It must be assumed that *every* password the user allowed their browser to remember is now in the hands of the attacker, requiring immediate, widespread remediation.

Execution and Theft Mechanics
These stealers are typically dropped by other malware (like initial access brokers or macro-enabled documents). Upon execution, they do not need advanced privileges. They simply navigate to the known local application data paths for popular browsers (e.g., `%LocalAppData%\Google\Chrome\User Data\Default\Login Data`). They query the local SQLite databases (`T1005`) where the passwords are stored. To decrypt the passwords, they abuse legitimate Windows APIs like `CryptUnprotectData` (DPAPI) (`T1555.003`), bypassing the need for a master password. The decrypted credentials are then formatted into a text file or JSON object and exfiltrated to the C2 server.

Indicators of Compromise & Impact
The impact is the total compromise of the user's online identity and access. Host-based IoCs include EDR alerts for anomalous, non-browser processes attempting to read the browser's `Login Data` or `Cookies` files, and suspicious calls to `CryptUnprotectData`. Network IoCs include a short burst of outbound HTTP/HTTPS or FTP traffic immediately following execution, as the stolen credential file is uploaded.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BROWSERPWDSTEALER {
    meta:
        description = "Detects Browserpwdstealer (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "browserpwdstealer" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Browserpwdstealer Activity
id: 2fa2212e22889e98fa642ce5659ff0d2
status: experimental
description: Detects generic indicators of the browserpwdstealer malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*browserpwdstealer*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the machine and assume all saved web credentials have been stolen.
2. Initiate a forced password reset for *all* corporate accounts the user possessed, prioritizing VPN, email, and SSO portals.
3. Instruct the user to reset all personal passwords (banking, social media) from a known-clean device, starting with their primary email account.
4. Ensure Multi-Factor Authentication (MFA) is strictly enforced across all critical applications to mitigate the use of stolen passwords.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the user back onto the network until their primary credentials have been rotated.
2. Avoid letting users store sensitive corporate passwords in their browser's built-in password manager; utilize a dedicated, enterprise-grade password vault.

References & External Analysis

• Search "browserpwdstealer" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Picsys
• Mailcheck
• Redsip
• Maxdriver
• Hploki

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/browserpwdstealer.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.