T1555.003

Credentials from Password Stores: Web Browsers

discovered 2026-05-28

Reads Chromium Login Data and decrypts saved passwords with aes-256-gcm (v10/v11 schemes). ATTRIBUTED to the convicted @apexcraft/nano-key root lineage from prior SafeDep triage and external triage c1896; not decoded in this static pass.

View on MITRE ATT&CK

Seen in packages

Campaigns