Claude FakeAgent libcef.dll Sideload or Browser Credential Store Access

Emiliano Mema@Nosalva

•updated Aug 31, 2026•11•0•15

This rule detects two suspicious patterns: 1) DLL sideloading of 'libcef.dll' by processes like 'ClaudeDesktop.exe' or JetBrains-related tools when executed from non-standard directories like 'Downloads', 'Temp', or 'AppData'. 2) Unauthorized access to common browser credential storage files (e.g., 'Login Data', 'Cookies') by processes other than standard browsers.