Non-browser process reads Chromium Login Data/Cookies SQLite files

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

Detects unauthorized processes (e.g., cmd.exe, powershell.exe, node.exe) accessing sensitive web browser files like 'Login Data' or 'Cookies' in common browser directories. This behavior is indicative of credential theft or data exfiltration attempts.