Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Credential Access/ T1555.003

T1555.003Credentials from Web Browsers

T1555.003 — Credentials from Web Browsers is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 22 detection use cases covering it and 146 threat-intel articles citing it.

Credential Access
View on the matrix → Filter Detection Library MITRE official spec ↗
22Use cases
146Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1555 · Credentials from Password Stores

Use cases covering this technique (22)

Infostealer — non-browser process accessing browser cookie/login DBs Internal actions · alerting DSΣP [WEEKLY] Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN Internal actions · alerting DSP [WEEKLY] Developer interpreter / package-manager process exfiltrating tokens to public code-hosting / worker domains Internal install · alerting DSPDDCSCW [WEEKLY] Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes Internal actions · alerting DSPDD [WEEKLY] npm/yarn/pnpm Install-Hook Spawn → Credential-Store Read or Worm-Payload Drop in node_modules Internal install · alerting DSΣPDD [WEEKLY] Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access Internal install · alerting DSPDD [WEEKLY] Supply-chain repo credential theft → outbound exfil to attacker infra Internal actions · alerting DSPDD Non Chrome Process Accessing Chrome Default Dir ESCU actions · hunting P Non Firefox Process Access Firefox Profile Dir ESCU actions · hunting P Possible Browser Pass View Parameter ESCU actions · hunting P Windows Credentials from Password Stores Chrome Copied in TEMP Dir ESCU actions · alerting P Windows Credentials from Web Browsers Saved in TEMP Folder ESCU actions · alerting P [LLM] Node.js spawning Python credential-stealer child Bespoke actions · alerting DSΣPDDCS [LLM] ChromEggscalator: Chromium launched with --remote-debugging-port for cookie/credential theft Bespoke actions · alerting DSΣPDDCS [LLM] CastleStealer/Starland RAT accessing browser credential stores and crypto wallets Bespoke actions · hunting DSΣPDDCS [LLM] Atomic Arch infostealer: build-spawned process harvesting SSH keys, dev tokens and browser/Electron sessions Bespoke actions · hunting DSΣPCS [LLM] Mastra easy-day-js second-stage stealer payload by SHA256 Bespoke install · hunting DSΣPDDCS [LLM] Non-browser process copying Chrome/Edge/Brave Login Data, Web Data, or wallet extension LevelDB state Bespoke actions · alerting DSΣPDDCS [LLM] AI agent skill exfiltrates GitHub token / env secrets via dynamic-context shell-out Bespoke actions · alerting DSΣPDDCS [LLM] MuddyWater CE-Notes / LP-Notes / Blub stealer staging-file writes Bespoke actions · alerting DSΣPDDCS [LLM] Non-browser process reading Chrome/Edge/Opera Login Data or Local State Bespoke actions · alerting DSΣPDDCS [LLM] Discord webhook / CDN exfiltration from non-browser process (Empyrean stealer C2) Bespoke actions · hunting DSPDDCS

Articles citing this technique (146)

crit Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js art-30
crit 2026 Mid-Year Update: On Pace for Our Biggest Year Yet art-33
crit Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root art-48
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update art-64
crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-65
high Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable art-71
crit Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available art-72
high Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git art-73
crit CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking art-74
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE art-75
crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts art-76
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-77
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-96
crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-97
high ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link art-99
crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry art-102
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants art-103
crit NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats art-104
crit Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say art-105
high Real world incident response: Microsoft and AXA XL strengthen cyber resilience art-117
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-141
crit Unauthenticated RCE in WordPress core (wp2shell), via SQL injection art-142
high ACR Stealer: Two observed intrusion chains amid increased threat activity art-146
crit Begun, the Patch Wars have art-150
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
high Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery art-157
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-163
crit [GHSA / CRITICAL] CVE-2026-47156: MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator art-166
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-168
crit OkoBot: new sophisticated malware framework targets cryptocurrency users art-169
high AsyncAPI npm packages backdoored via GitHub Actions art-181
high How Aikido Intel detects malware and vulnerabilities first art-189
crit What is a dependency firewall? art-192
crit jscrambler npm package publishes malicious preinstall binary art-195
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-196
high GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps art-197
crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-198
crit [GHSA / CRITICAL] CVE-2026-54069: SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist art-205
crit [GHSA / CRITICAL] CVE-2026-52777: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize art-211
crit Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry art-215
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-216
crit ESET Threat Report H1 2026 art-221
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-223
crit Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign art-250
crit 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions art-253
crit Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects art-265
high 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers art-277
crit Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector art-280
high Top Koi alternatives in 2026 art-290
crit CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure art-293
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-294
high Everybody's shipping code they can't read art-295
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-299
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
crit OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat art-302
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-303
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-316
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-322
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-325
high Multiple JetBrains IDE plugins caught stealing AI keys art-326
high npm v12 delivers one of the biggest security improvements in years art-339
crit Compromised Rust crate onering performs code exfiltration art-346
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-350
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System art-352
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-362
high Nx Console VS Code Extension Compromised art-373
crit Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm art-379
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-380
high What MDM can't protect on developer machines (and what to do about it) art-386
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-388
high Why developer machines are now the number one target for supply chain attacks art-396
crit Laravel Lang Supply Chain Advisory art-399
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-400
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-406
high Dev Machine Guard Now Supports Linux art-410
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-411
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-412
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-422
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-423
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-425
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-428
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-431
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-437
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-440
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-442
crit Security metamorphosis: a Mythos-ready architecture checklist for autonomous AI attacks art-454
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-456
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-457
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-458
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-459
high Popular PyTorch Lightning Package Compromised by Mini Shai-Hulud art-462
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-466
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-468
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-469
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-471
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-475
high It's time to treat browser extensions like supply chain attack vectors art-477
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-483
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-489
high Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow art-501
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-517
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-523
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-525
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-527
high Aikido Attack finds multiple 0-days in Hoppscotch art-528
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-534
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-535
high axios compromised on npm: maintainer account hijacked, RAT deployed art-543
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
crit Popular telnyx package compromised on PyPI by TeamPCP art-547
high Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags art-550
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-552
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-555
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-556
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-565
high CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran art-566
high TeamPCP deploys CanisterWorm on NPM following Trivy compromise art-567
crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580
crit fast-draft Open VSX Extension Compromised by BlokTrooper art-581
high Glassworm Strikes Popular React Native Phone Number Packages art-587
crit Sednit reloaded: Back in the trenches art-596
crit How SMBs use threat research and MDR to build a defensive edge art-601
crit Protecting education: How MDR can tip the balance in favor of schools art-607
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-640
crit Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise art-672
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-728
crit ESET Threat Report H2 2025 art-732
med MuddyWater: Snakes by the riverbank art-756
crit ESET APT Activity Report Q2 2025–Q3 2025 art-793
high npm Supply Chain Attack via Open Source maintainer compromise art-855
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-865
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-900
high Ultralytics AI Pwn Request Supply Chain Attack art-1125
high Lottie Player npm package compromised for crypto wallet theft art-1168
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1296
crit Exploring WebExtension security vulnerabilities in React Developer Tools and Vue.js devtools art-1483
high XS leaks: What they are and how to avoid them art-1640
med Security implications of HTTP response headers art-1743
high Preventing XSS in Django art-1814
high Comparing Node.js web frameworks: Which is most secure? art-1818
med You should be using HTTP Strict Transport Security (HSTS) headers in your Node.js server art-1874
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2072
high Java Top 10 Security Vulnerabilities Disclosed [2019 - List] art-3516
high The most common vulnerabilities in Maven Central and npm art-3605
med Snyk is Now Integrated with Chrome’s Lighthouse art-3614
crit XSS Attacks: The Next Wave art-3641