Browser Credential Theft
Reading saved passwords and session cookies from a browser's local profile store by calling the same OS decryption API a legitimate password manager would use.
Every major browser stores saved logins and session cookies in a local SQLite database, encrypted at rest with an OS-provided secret store rather than a password of the user's choosing. That secret store is exactly the point of attack: malware doesn't need to break any cryptography, it only needs to call the same decryption primitive the browser itself calls, from a process running as the logged-in user.
How it works
The encryption backend differs per OS, but the pattern is identical everywhere — read the encrypted blob from the profile's database file, then hand it to the platform's own secret-unwrapping API:
| OS | Storage | Decryption primitive |
|---|---|---|
| Windows | Login Data SQLite file, AppData\Local\...\User Data | DPAPI CryptUnprotectData, tied to the logged-in user account |
| macOS | Login Data SQLite file, per-profile | The browser's entry in the user's Keychain |
| Linux | Login Data SQLite file | libsecret/GNOME Keyring, or a fixed key if no keyring daemon is running |
Session cookies are stolen the same way, and are often more immediately valuable than a password: a valid, unexpired session cookie can authenticate to a web service without ever triggering a login or MFA prompt at all.
Detection & analysis
- Static — A sample that reads a browser profile directory (
User Data,~/Library/Application Support/Google/Chrome,~/.mozilla) and callsCryptUnprotectData/Keychain/libsecretAPIs, especially bundled with SQLite-parsing code, is a strong static indicator on its own. - Dynamic — File-access telemetry on
Login Data/CookiesSQLite files from a process other than the browser itself; on Windows,CryptUnprotectDatacalls from a non-browser process targeting browser DPAPI blobs are a reliable EDR signal. - Impact of session-cookie theft — because a stolen session cookie bypasses authentication entirely, treat confirmed browser-credential theft as requiring both password resets and forced session invalidation for every affected account, not password resets alone.
- Tools — Sysmon/EDR file-access and API-call telemetry,
strings/YARA over a sample for hard-coded browser profile paths (a very common, low-effort static tell in commodity infostealers), OS-level DPAPI/Keychain audit logging where available.