CastleLoader - Browser Database Credential Scraping (T1555.003)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•2•0•5

Detects the CastleLoader Python process rapidly scraping Chromium SQLite databases (Login Data, Cookies) to steal stored credentials and session cookies. The rule identifies Python processes accessing multiple browser credential/session databases within a one-minute window.