Djinn Stealer Credential DB Harvesting from Non-Browser Process (TaskWeaver Post-Exploitation)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

Detects unauthorized processes, such as TaskWeaver implants or scripts (node.exe, wscript.exe, cscript.exe) running from non-standard directories (e.g., %TEMP%, %APPDATA%), attempting to access web browser credential databases. This behavior is indicative of post-exploitation credential harvesting, specifically linked to Djinn Stealer activity following CVE-2026-48558 exploits.