Credentials from Password Stores: Keychain

Reuses the phished login password to unlock the login Keychain and extract Safe Storage keys that decrypt Chromium-family cookies and saved passwords; also exfiltrates all *.keychain-db files.