Lumma Stealer - Browser Credential Vault Access Outside Browser Process

Ibrahim Saud@tektrix

•updated Jun 17, 2026•2•0•4

This rule detects attempts by non-browser processes to access browser credential stores (Login Data, Cookies, Web Data). Specifically, it monitors file read, access, or copy actions on known credential database paths for Chrome, Edge, Firefox, Brave, and Opera, and flags any activity originating from processes other than the legitimate browser executables or common security software.