Credentials from Password Stores: Credentials from Web Browsers

APT3 has used tools to dump passwords from browsers.^[54]

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.^[55][56]

APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.^[48]

Azorult can steal credentials from the victim's browser.^[29]

Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.^[16]

BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.^[30][31]

ChChes steals credentials stored inside Internet Explorer.^[24]

CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.^[40]

Crimson contains a module to steal credentials from Web browsers on the victim machine.^[21]

Emotet has been observed dropping browser password grabber modules. ^[41]

Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome.^[7]

H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.^[18]

Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.^[15]

Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.^[63]

jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.^[32]

KeyBoy attempts to collect passwords from browsers.^[27]

Kimsuky has used a Google Chrome extension to steal passwords and cookies from their browsers.^[53]

KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.^[22]

LaZagne can obtain credentials from web browsers such as Google Chrome, Internet Explorer, and Firefox.^[6]

Leafminer used several tools for retrieving login and password information, including LaZagne.^[57]

Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.^[46]

Machete collects stored credentials from several web browsers.^[39]

Magic Hound used FireMalv, custom-developed malware, which collected passwords from the Firefox browser storage.^[65]

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI.^{[10][11][12][13]}

Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.^[47]

MuddyWater has run a tool that steals passwords saved in victim web browsers.^[50]

njRAT has a module that steals passwords saved in victim web browsers.^[33][34][35]

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.^{[58][59][60][61]} OilRig has also used tools named VALUEVAULT and PICKPOCKET to dump passwords from web browsers.^[61]

OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.^[23]

Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.^[1]

Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.^[49]

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer. ^[40]

PLEAD has the ability to steal saved credentials from web browsers.^[43][44]

PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.^[42]

A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.^[17]

Proton gathers credentials for Google Chrome.^[36]

Pupy can use Lazagne for harvesting credentials.^[14]

QuasarRAT can obtain passwords from common web browsers.^[8][9]

RedLeaves can gather browser usernames and passwords.^[25]

ROKRAT steals credentials stored in Web browsers by querying the sqlite database.^[26]

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.^[64]

Smoke Loader searches for credentials stored from web browsers.^[37]

Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.^[62]

Stolen Pencil has used tools that are capable of obtaining credentials from web browsers.^[51]

TA505 has used malware to gather credentials from Internet Explorer.^[52]

TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge.^[38]

TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.^[45]

Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.^[20]

XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.^[19]

Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.^[28]

Organizations may consider weighing the risk of storing credentials in web browsers. If web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in web browsers.