TokenGrabber Stealer: Chromium Login Data/Cookies/Web Data Staging

Ankit Mehta@Secvyn

•updated Sep 28, 2026•2•0•3

Detects unauthorized processes accessing sensitive credential storage files (e.g., 'Login Data', 'Cookies', 'Local State') from known Chromium-based browser profile directories. This activity is indicative of credential harvesting by infostealer malware attempting to exfiltrate browser data before performing decryption.