Chromepass

Overview

HackTool:Win32/Chromepass is a highly specific utility categorized as a Credential Dumper. While it can technically be used legitimately to recover forgotten passwords, it is overwhelmingly utilized by threat actors, embedded within larger info-stealer malware, or executed during hands-on-keyboard attacks to systematically extract all saved passwords from the Google Chrome web browser.

Understanding Chromepass (Credential Dumping)
To an end-user, this tool operates silently; they will not know their passwords have been stolen until their accounts are compromised. For a SOC analyst, the execution of Chromepass is a severe incident indicating that an attacker has gained execution privileges on the endpoint and is actively harvesting credentials (`T1003.001`) to facilitate lateral movement or data theft.

Execution and Extraction Mechanics
Google Chrome stores saved usernames and passwords in a local SQLite database file (typically located at `%LocalAppData%\Google\Chrome\User Data\Default\Login Data`). The passwords within this database are encrypted using the Windows Data Protection API (DPAPI), which ties the encryption key to the currently logged-in Windows user's credentials. Chromepass operates by programmaticly interacting with the DPAPI (`T1555.003`). Because the attacker executes Chromepass within the context of the logged-in user, the tool simply requests Windows to decrypt the database. It then parses the SQLite file and outputs a cleartext list of URLs, usernames, and passwords.

Indicators of Compromise & Impact
The impact is the total compromise of all web credentials saved in the user's browser, potentially leading to unauthorized access to corporate SSO portals, email, and financial accounts. Host-based IoCs include EDR alerts for 'Suspicious Credential Dumping Activity' or processes attempting to unexpectedly read the `Login Data` SQLite file. Command-line logging (Event ID 4688) may capture the execution of known Chromepass binaries or PowerShell scripts interacting with the `CryptUnprotectData` API.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003.001: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.
• T1059.001: Restrict execution of PowerShell. Enforce PowerShell Constrained Language Mode and Script Block Logging.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_CHROMEPASS {
    meta:
        description = "Detects Chromepass (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "chromepass" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Chromepass Activity
id: 6c98d3434aa1228fb18e219ac57a2940
status: experimental
description: Detects generic indicators of the chromepass malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*chromepass*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Mandate an immediate password reset for the compromised user, covering ALL corporate accounts and services they access.
2. Force a session token revocation for the user across all SaaS applications and internal portals (e.g., Microsoft 365, Okta, VPN).
3. Isolate the endpoint to prevent the extracted credentials from being used for immediate lateral movement.
4. Analyze EDR telemetry to determine how Chromepass was executed (e.g., dropped by an info-stealer, or run manually via a reverse shell).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume only the 'work' passwords were stolen; attackers will use personal credentials to access bank accounts and personal email.
2. Avoid relying solely on file hashes to detect this tool; the extraction logic can easily be compiled into custom, evasive scripts.

References & External Analysis

• Search "chromepass" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Keywordfind
• Tencent
• Openinstall
• Smartpctweaker
• Scramupx

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/chromepass.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.