Applied Cybernetics Group
T1555.003 Credentials from Web Browsers
- Technique
T1555.003- Tactics
- Credential Access
- Research, 90 days
- 6
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 8
- Elastic, Splunk
- 8
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1555/003
MITRE description
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, <code>AppData\Local\Google\Chrome\User Data\Default\Login Data</code> and executing a SQL query: <code>SELECT action_url, username_value, password_value FROM logins;</code>. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function <code>CryptUnprotectData</code>, which uses the victim’s cached logon credentials as the decryption key.(Citation: Microsoft CryptUnprotectData April 2018) Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004). Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016) After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-11-03ESET: Gorbag: Orcs at the border harvesting intelligence from Ukraine -
2026-10-22Group-IB: Inside SiriusQT: A Seriously Skilled RAT -
2026-10-21Flare: Measuring Credential Exposure of Contractors and Integrators After the Refrigeration System Attack in France: 601 Industrial Remote Access Addresses Recovered From Stealer Logs, 73% on the Largest Platform Paired With Device Credentials -
2026-10-15Flare: Analysis After the Refrigeration System Attack in France: Two Thirds of Exposed Refrigeration Controllers Share an Address with Cameras, Remote Desktop, and VPNs -
2026-10-06Flare: CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery -
2026-08-23Darktrace: When AI Becomes the Lure: A Fake Gemini Installer Delivers Vidar
Detection coverage
SigmaHQ community rules
- Access To Browser Credential Files By Uncommon Applications - Security (threat-hunting)
- Suspicious File Access to Browser Credential Storage (core)
- Access to Browser Login Data (core)
- HackTool - WinPwn Execution - ScriptBlock (core)
- HackTool - WinPwn Execution (core)
- PUA - WebBrowserPassView Execution (core)
- SQLite Chromium Profile Data DB Access (core)
- Potential Browser Data Stealing (core)
Elastic and Splunk rules
- Multiple Credential Access by VS Code or Cursor IDE Descendant (elastic)
- Keychain Password Retrieval via Command Line (elastic)
- Suspicious Web Browser Sensitive File Access (elastic)
- Browser Process Spawned from an Unusual Parent (elastic)
- Non Chrome Process Accessing Chrome Default Dir (splunk)
- Non Firefox Process Access Firefox Profile Dir (splunk)
- Windows Credentials from Password Stores Chrome Copied in TEMP Dir (splunk)
- Windows Credentials from Web Browsers Saved in TEMP Folder (splunk)