Loading malware…
ChromeKatz is a browser credential theft tool focused primarily on Google Chrome and other Chromium-based browsers on Windows. It is designed to recover saved credentials and session material, including cookies, by extracting secrets from browser process memory and by accessing browser data stores. Public reporting also describes ChromeKatz-derived implementations that support live cookie extraction from Chromium process memory, stored password extraction from on-disk databases, and techniques intended to bypass newer Chromium protections such as App-Bound Encryption. Some reporting additionally notes support for Firefox credential decryption through NSS/SDR-related methods in derivative modules.
ChromeKatz has been referenced both as a standalone open-source capability and as functionality reimplemented or embedded by other malware families. Rust-based infostealers such as EDDIESTEALER have incorporated ChromeKatz-like logic for Chromium data theft, including memory scraping and abuse of browser remote debugging features. ChromeKatz has also been deployed in espionage intrusions attributed to the China-linked Lotus Panda group, alongside other credential theft tooling, to siphon Chrome passwords and cookies.
The malware’s core tradecraft aligns with modern infostealer adaptation to Chromium hardening on Windows. Rather than relying solely on older DPAPI-based decryption paths, ChromeKatz-style approaches extract cookies directly from browser memory or abuse browser debugging interfaces to obtain plaintext secrets. These methods are intended to preserve access to browser credentials and authenticated web sessions even as browser vendors raise the bar for direct database decryption. ChromeKatz is therefore best characterized as a specialized browser-focused credential and cookie theft utility used in both commodity theft ecosystems and targeted intrusion sets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Also deployed in the attacks are a reverse SSH tool, and two credential stealers ChromeKatz and CredentialKatz that are equipped to siphon passwords and cookies stored in the Google Chrome web browser.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
It is still possible of course to attempt obtaining the cookies via the browser's process memory dump...
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A credential-theft module/tool referenced as the basis for CornFlake’s browser credential theft capability and as an on-demand extraction function in the operator panel.
A credential-theft module referenced as the basis for CornFlake’s browser credential theft capability and as a taskable extraction feature in the operator panel.
An open-source browser credential/cookie extraction technique/tool whose logic was reimplemented in Rust by EDDIESTEALER to bypass Chromium protections and access unencrypted sensitive browser data.
ChromeKatz is a credential stealer designed to extract passwords and cookies from the Google Chrome browser.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.