RevStealer Browser Credential and Slack/Discord Session Token Harvesting

Ibrahim Saud@tektrix

•updated 13 days ago•2•0•2

Detects non-browser and non-messaging processes accessing both browser credential stores (like 'Login Data' or 'Cookies') and messaging application session storage (Slack/Discord LevelDB) in a single session. This pattern is characteristic of credential-stealing malware, such as RevStealer, which targets both saved web browser credentials and application session tokens for exfiltration.