Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Credential Access/ T1555.003

T1555.003Credentials from Web Browsers

T1555.003 — Credentials from Web Browsers is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 24 detection use cases covering it and 175 threat-intel articles citing it.

Credential Access
View on the matrix → Filter Detection Library MITRE official spec ↗
24Use cases
175Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1555 · Credentials from Password Stores

Use cases covering this technique (24)

Infostealer — non-browser process accessing browser cookie/login DBs Internal actions · alerting DSΣP [WEEKLY] Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN Internal actions · alerting DSP [WEEKLY] Developer interpreter / package-manager process exfiltrating tokens to public code-hosting / worker domains Internal install · alerting DSPDDCSCW [WEEKLY] Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes Internal actions · alerting DSPDD [WEEKLY] npm/yarn/pnpm Install-Hook Spawn → Credential-Store Read or Worm-Payload Drop in node_modules Internal install · alerting DSΣPDD [WEEKLY] Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access Internal install · alerting DSPDD [WEEKLY] Supply-chain repo credential theft → outbound exfil to attacker infra Internal actions · alerting DSPDD Non Chrome Process Accessing Chrome Default Dir ESCU actions · hunting P Non Firefox Process Access Firefox Profile Dir ESCU actions · hunting P Possible Browser Pass View Parameter ESCU actions · hunting P Windows Credentials from Password Stores Chrome Copied in TEMP Dir ESCU actions · alerting P Windows Credentials from Web Browsers Saved in TEMP Folder ESCU actions · alerting P [LLM] Suspicious ProcessAccess to chrome.exe / msedge.exe with injection-grade rights Bespoke actions · alerting DSΣPDD [LLM] macOS browser 'Safe Storage' master-key theft via security find-generic-password Bespoke actions · alerting DSΣPCS [LLM] Non-Chrome process accessing Google Chrome synced-passkey LevelDB store Bespoke actions · alerting DSΣPDDCS [LLM] Command line referencing Chrome Sync Data LevelDB passkey path (copy/stage for exfil) Bespoke actions · alerting DSΣPDDCS [LLM] Browser credential-store theft via OctLurk browser password decryptor Bespoke actions · hunting DSΣPCS [LLM] CastleStealer/Starland RAT accessing browser credential stores and crypto wallets Bespoke actions · hunting DSΣPDDCS [LLM] Atomic Arch infostealer: build-spawned process harvesting SSH keys, dev tokens and browser/Electron sessions Bespoke actions · hunting DSΣPCS [LLM] Mastra easy-day-js second-stage stealer payload by SHA256 Bespoke install · hunting DSΣPDDCS [LLM] AI agent skill exfiltrates GitHub token / env secrets via dynamic-context shell-out Bespoke actions · alerting DSΣPDDCS [LLM] MuddyWater CE-Notes / LP-Notes / Blub stealer staging-file writes Bespoke actions · alerting DSΣPDDCS [LLM] Non-browser process reading Chrome/Edge/Opera Login Data or Local State Bespoke actions · alerting DSΣPDDCS [LLM] Discord webhook / CDN exfiltration from non-browser process (Empyrean stealer C2) Bespoke actions · hunting DSPDDCS

Articles citing this technique (175)

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE art-03
crit Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects art-05
high Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection art-08
crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10
crit Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access art-23
crit Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies art-25
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
crit New AmnesiaStealer macOS malware hijacks browser sessions via remote control art-33
crit Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List. art-35
crit SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch art-37
crit Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner art-38
high Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware art-40
high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth art-43
high Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers art-44
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps art-45
high Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware art-46
crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud art-49
high GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE art-50
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories art-51
crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure art-53
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS art-55
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud art-58
crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring art-59
crit Dissecting the JWR phishing framework art-60
high Armored Likho expands its cyber-espionage toolkit art-62
crit Attackers Exploit SharePoint Authentication Bypass After Public PoC Release art-63
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64
med Control Which Package Registries Your CI Jobs and Developer Machines Use art-65
high 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One art-66
high OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning art-69
crit Enterprise Defenses Recovered at the Edge and Collapsed Inside art-70
crit Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws art-71
crit Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access art-72
crit Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations art-73
crit SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code art-74
crit ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access art-75
crit Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS art-76
high Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing art-79
crit Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client art-80
crit Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands art-81
high DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt art-82
crit OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development art-84
crit A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices art-85
crit Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo art-86
crit Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers art-88
high Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 art-89
high Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets art-90
crit Kimwolf v7: An Evolution of the Kimwolf Botnet art-92
crit The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications art-96
high Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise art-97
crit IT threat evolution in Q2 2026. Non-mobile statistics art-99
crit Inside the Modern SOC: The Identity Front Door art-102
crit [GHSA / CRITICAL] GHSA-wg23-69c2-gjc8: Craft CMS: Passkey login accepts replayed WebAuthn assertions art-106
crit ChainDrop: Inside a Self-Propagating npm Worm art-108
high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources art-112
crit From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide art-116
high Almost Half of Malware Samples Communicate Direct to IP art-132
crit How legitimate cloud platforms enable phishers to bypass MFA art-133
high Keyv and friends compromised in active Shai-Hulud supply chain attack art-134
crit Pass the Passkey: A Novel Attack Surface in Passwordless Authentication art-147
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version art-160
crit Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan art-163
crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169
crit Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks art-170
crit 2026 Mid-Year Update: On Pace for Our Biggest Year Yet art-182
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-193
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-246
crit Unauthenticated RCE in WordPress core (wp2shell), via SQL injection art-247
crit Begun, the Patch Wars have art-253
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
crit Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories art-259
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-263
crit [GHSA / CRITICAL] CVE-2026-47156: MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator art-266
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-267
high AsyncAPI npm packages backdoored via GitHub Actions art-276
high How Aikido Intel detects malware and vulnerabilities first art-284
crit What is a dependency firewall? art-287
crit jscrambler npm package publishes malicious preinstall binary art-290
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-291
high GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps art-292
crit [GHSA / CRITICAL] CVE-2026-54069: SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist art-300
crit [GHSA / CRITICAL] CVE-2026-52777: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize art-306
crit Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry art-308
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-309
crit ESET Threat Report H1 2026 art-312
crit 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions art-324
high 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers art-332
high Top Koi alternatives in 2026 art-341
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-344
high Everybody's shipping code they can't read art-345
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-349
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-352
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-364
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-370
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-373
high Multiple JetBrains IDE plugins caught stealing AI keys art-374
high npm v12 delivers one of the biggest security improvements in years art-385
crit Compromised Rust crate onering performs code exfiltration art-392
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-396
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System art-398
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-408
high Nx Console VS Code Extension Compromised art-419
crit Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm art-425
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-426
high What MDM can't protect on developer machines (and what to do about it) art-432
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-434
high Why developer machines are now the number one target for supply chain attacks art-442
crit Laravel Lang Supply Chain Advisory art-445
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-446
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-452
high Dev Machine Guard Now Supports Linux art-456
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-457
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-458
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-468
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-469
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-471
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-474
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-477
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-483
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-486
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-488
crit Security metamorphosis: a Mythos-ready architecture checklist for autonomous AI attacks art-499
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-501
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-502
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-503
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-504
high Popular PyTorch Lightning Package Compromised by Mini Shai-Hulud art-507
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-511
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-513
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-515
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-520
high It's time to treat browser extensions like supply chain attack vectors art-522
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-528
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-534
high Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow art-546
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-562
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-568
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-570
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-572
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-577
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-578
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
high Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags art-591
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-593
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-596
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-597
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-605
crit Sednit reloaded: Back in the trenches art-629
crit How SMBs use threat research and MDR to build a defensive edge art-634
crit Protecting education: How MDR can tip the balance in favor of schools art-640
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-673
crit Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise art-705
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758
crit ESET Threat Report H2 2025 art-762
med MuddyWater: Snakes by the riverbank art-786
high npm Supply Chain Attack via Open Source maintainer compromise art-878
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-888
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-924
high Ultralytics AI Pwn Request Supply Chain Attack art-1149
high Lottie Player npm package compromised for crypto wallet theft art-1191
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1319
crit Exploring WebExtension security vulnerabilities in React Developer Tools and Vue.js devtools art-1506
high XS leaks: What they are and how to avoid them art-1663
med Security implications of HTTP response headers art-1766
high Preventing XSS in Django art-1837
high Comparing Node.js web frameworks: Which is most secure? art-1841
med You should be using HTTP Strict Transport Security (HSTS) headers in your Node.js server art-1897
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2095
high Java Top 10 Security Vulnerabilities Disclosed [2019 - List] art-3539
high The most common vulnerabilities in Maven Central and npm art-3628
med Snyk is Now Integrated with Chrome’s Lighthouse art-3637
crit XSS Attacks: The Next Wave art-3664