Technique:  Credentials from Password Stores:Credentials from Web Browsers
Agent Tesla can gather credentials from a number of browsers.
It has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.
It has used tools to dump passwords from browsers.
It has used a variety of publicly available tools like LaZagne to gather credentials.
It has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.
Azorult can steal credentials from the victim's browser.
Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.
BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.
BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.
Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.
Chaes can steal login credentials and stored financial information from the browser.
ChChes steals credentials stored inside Internet Explorer.
CookieMiner can steal saved usernames and passwords in Chrome as well as credit card credentials.
CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.
Crimson contains a module to steal credentials from Web browsers on the victim machine.
Emotet has been observed dropping browser password grabber modules.
Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome.
It has used the Stealer One credential stealer to target web browsers.
Grandoreiro can steal cookie data and credentials from Google Chrome.
H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.
It has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.
Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.
It used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.
Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.
jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.
KeyBoy attempts to collect passwords from browsers.
KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.
It has used browser extensions including Google Chrome to steal passwords and cookies from browsers. It has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.
KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.
It has obtained passwords and session tokens with the use of the Redline password stealer.
LaZagne can obtain credentials from web browsers such as Google Chrome, Internet Explorer, and Firefox.
It used several tools for retrieving login and password information, including LaZagne.
Lizar has a module to collect usernames and passwords stored in browsers.
Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.
It collects stored credentials from several web browsers.
Melcoz has the ability to steal credentials from web browsers.
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI.
It used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.
It has run tools including Browser64 to steal passwords saved in victim web browsers.
NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.
njRAT has a module that steals passwords saved in victim web browsers.
It has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. It has also used tool named PICKPOCKET to dump passwords from web browsers.
OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.
Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.
It dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.
PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer.
PLEAD can harvest saved credentials from browsers such as Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox.
PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.
A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.
Proton gathers credentials for Google Chrome.
Pupy can use Lazagne for harvesting credentials.
QakBot has collected usernames and passwords from Firefox and Chrome.
QuasarRAT can obtain passwords from common web browsers.
RainyDay can use tools to collect credentials from web browsers.
RedLeaves can gather browser usernames and passwords.
ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.
It's CredRaptor tool can collect saved passwords from various internet browsers.
SILENTTRINITY can collect clear text web credentials for Internet Explorer/Edge.
Smoke Loader searches for credentials stored from web browsers.
During the SolarWinds Compromise, It stole users' saved passwords from Chrome.
It malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.
SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.
It has used malware to gather credentials from Internet Explorer.
TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.
Trojan.Karagany can steal data and credentials from browsers.
TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.
Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.
WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.
XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.
Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.
ItM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.