Abyssos Recovery Credential Harvester Modules

Duo Tech@duotech

•updated Aug 11, 2026•0•0•3

Detects Abyssos RECOVERY and RECOVERY_GECKO modules used to harvest Chrome/Firefox credentials, requiring an unsigned executable freshly dropped in the Windows temp folder using the rcv/rvg naming pattern that references browser credential stores (Chrome Login Data, Firefox key4.db) alongside the module's hardcoded XOR decryption key