JSCeal Chromium browser profile enumeration via node.exe

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

Detects Node.js or Electron processes executing from suspicious paths (e.g., Temp, Roaming) while interacting with web browser credential files or executing commands consistent with automated credential dumping tools.