Larva-24009 NirSoft credential/browser recon tool execution

Duo Tech@duotech

•updated Aug 4, 2026•1•0•2

Detects the download, file creation, or execution of known NirSoft credential and browser harvesting utilities (ChromePass, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) from non-standard directories or identified malicious actor infrastructure.