Infostealer Browser Credential Store Access by Non-Browser Process

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects when processes other than standard web browsers (Chrome, Edge, Firefox, Brave, Opera) attempt to read sensitive browser data files such as 'Login Data', 'Cookies', or 'Web Data'. These files contain stored credentials and session information, and unauthorized access is a common technique used by credential-stealing malware to exfiltrate sensitive user information.