value:  BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox Google Chrome and Internet Explorer. ;; Carberp's passw.plug plugin can gather passwords saved in Opera Internet Explorer Safari Firefox and Chrome. ;; ChChes steals credentials stored inside Internet Explorer. ;; CookieMiner can steal saved usernames and passwords in Chrome as well as credit card credentials. ;; CosmicDuke collects user credentials including passwords for various programs including Web browsers. ;; Crimson contains a module to steal credentials from Web browsers on the victim machine. ;; Emotet has been observed dropping browser password grabber modules. ;; Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome. ;; FIN6 has used the Stealer One credential stealer to target web browsers. ;; Grandoreiro can steal cookie data and credentials from Google Chrome. ;; H1N1 dumps usernames and passwords from Firefox Internet Explorer and Outlook. ;; Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords. ;; Inception used a browser plugin to steal passwords and sessions from Internet Explorer Chrome Opera Firefox Torch and Yandex. ;; Javali can capture login credentials from open browsers including Firefox Chrome Internet Explorer and Edge. ;; jRAT can capture passwords from common web browsers such as Internet Explorer Google Chrome and Firefox. ;; KeyBoy attempts to collect passwords from browsers. ;; KGH_SPY has the ability to steal data from the Chrome Edge Firefox Thunderbird and Opera browsers. ;; Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. ;; KONNI can steal profiles (containing credential information) from Firefox Chrome and Opera. ;; LaZagne can obtain credentials from web browsers such as Google Chrome Internet Explorer and Firefox. ;; Leafminer used several tools for retrieving login and password information including LaZagne. ;; Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers. ;; Machete collects stored credentials from several web browsers. ;; Melcoz has the ability to steal credentials from web browsers. ;; Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways including from DPAPI. ;; Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims. ;; MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers. ;; NETWIRE has the ability to steal credentials from web browsers including Internet Explorer Opera Yandex and Chrome. ;; njRAT has a module that steals passwords saved in victim web browsers. ;; OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers. ;; OLDBAIT collects credentials from Internet Explorer Mozilla Firefox and Eudora. ;; Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers. ;; Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data. ;; PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator Mozilla Firefox Mozilla Thunderbird and Internet Explorer. ;; PLEAD has the ability to steal saved credentials from web browsers. ;; PoetRAT has used a Python tool named Browdec.exe to steal browser credentials. ;; A module in Prikormka gathers logins and passwords stored in applications on the victims including Google Chrome Mozilla Firefox and several other browsers. ;; Proton gathers credentials for Google Chrome. ;; Pupy can use Lazagne for harvesting credentials. ;; QuasarRAT can obtain passwords from common web browsers. ;; RedLeaves can gather browser usernames and passwords. ;; ROKRAT steals credentials stored in Web browsers by querying the sqlite database. ;; Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers. ;; Smoke Loader searches for credentials stored from web browsers. ;; Stealth Falcon malware gathers passwords from multiple sources including Internet Explorer Firefox and Chrome. ;; Stolen Pencil has used tools that are capable of obtaining credentials from web browsers. ;; TA505 has used malware to gather credentials from Internet Explorer. ;; TrickBot can obtain passwords stored in files from web browsers such as Chrome Firefox Internet Explorer and Microsoft Edge sometimes using esentutl. ;; Trojan.Karagany can steal data and credentials from browsers. ;; TSCookie has the ability to steal saved passwords from the Internet Explorer Edge Firefox and Chrome browsers. ;; Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine. ;; XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords. ;; Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files. ;; ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.
name: Credentials from Password Stores: Credentials From Web Browsers