T1555.003 Credentials from Password Stores: Credentials from Web Browsers

2 threats tracked by Spectrum Delta use this technique.

T1555.003 on MITRE ATT&CK →

• n0n credential extortion

  Chrome driven over DevTools on cloned admin profiles

  Sysmon process-creation events for chrome.exe and netsh portproxy

  Seen in: Sysmon

• Aokigahara AI-session stealer

  Browser saved-credential collection

  EDR file-access events on browser-profile login and cookie stores by the stealer process

  Seen in: Sysmon / EDR