HackBrowserData

Reported Context (3)

credentials across local files, CI environments, Kubernetes, and Vault sources. It also drops the HackBrowserData binary, exfiltrates the collected data, establishes persistence on the host, and facilitates the Compromised Tensorlake npm Package Delivered Shai-Hulud Credential-Stealing Worm
The download server contained HackBrowserData, an open-source tool designed for information theft, which includes stealing credentials, history, and cookies stored in web browsers. Larva-26009 Uses Remote-Access Tools and SoftEther VPN in MS-SQL Server Attacks
Screenshot of the BrowserGhost README in GitHubAlongside BrowserGhost, the directory also contained HackBrowserData, a tool specifically built to extract and decrypt sensitive browser information. This combination of Open Directory Exposes Cobalt Strike, Phishing and Browser Credential Tools

CVE (2)

Malware (6)

People (1)

Threat Actors (1)

MITRE ATT&CK (13)

Products (11)

Tools (15)

Industries (2)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.