Procedure examples

GlassWorm has gathered credentials stored in Mozilla FireFox and Chromium-based Browsers.

Trojan.Karagany can steal data and credentials from browsers.

KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.

BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.

KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.

RedLine Stealer was designed to steal sensitive information from web browsers, including credit card details, saved credentials, and autocomplete data. RedLine Stealer can also gather credentials from several browsers.

Grandoreiro can steal cookie data and credentials from Google Chrome.

SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.

XLoader can gather credentials from several web browsers.

MgBot includes modules for stealing credentials from various browsers and applications, including Chrome, Opera, Firefox, Foxmail, QQBrowser, FileZilla, and WinSCP.

Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.

Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer.

PLEAD can harvest saved credentials from browsers such as Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox.

Raccoon Stealer collects passwords, cookies, and autocomplete information from various popular web browsers.

Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.

Proton gathers credentials for Google Chrome.

Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.

PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.

Melcoz has the ability to steal credentials from web browsers.

njRAT has a module that steals passwords saved in victim web browsers.

ChChes steals credentials stored inside Internet Explorer.

Manjusaka gathers credentials from Chromium-based browsers.

Agent Tesla can gather credentials from a number of browsers.

QakBot has collected usernames and passwords from Firefox and Chrome.

CookieMiner can steal saved usernames and passwords in Chrome as well as credit card credentials.

jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.

Lizar has a module to collect usernames and passwords stored in browsers.

H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.

Azorult can steal credentials from the victim's browser.

WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.

SILENTTRINITY can collect clear text web credentials for Internet Explorer/Edge.

Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome.

Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI.

LaZagne can obtain credentials from web browsers such as Google Chrome, Internet Explorer, and Firefox.

Pupy can use Lazagne for harvesting credentials.

QuasarRAT can obtain passwords from common web browsers.

During Juicy Mix, OilRig used a Windows Credential Manager stealer for credential access.

OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.

Turla has gathered credentials from the Windows Credential Manager tool.

Stealth Falcon malware gathers passwords from the Windows Credential Vault.

Wizard Spider has used PowerShell cmdlet `Invoke-WCMDump` to enumerate Windows credentials in the Credential Manager in a compromised network.

RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.

ROKRAT can steal credentials by leveraging the Windows Vault mechanism.

KGH_SPY can collect credentials from the Windows Credential Manager.

Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.

Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using `vaultcmd.exe` and another that can collect RDP access credentials using the `CredEnumerateW` function.

SILENTTRINITY can gather Windows Vault credentials.

PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.