BioShocking: Claude Extension Credential File Read via Chrome

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.