T1555.003
Credentials from Password Stores: Web Browsers
discovered 2026-05-28Reads Chromium Login Data and decrypts saved passwords with aes-256-gcm (v10/v11 schemes). ATTRIBUTED to the convicted @apexcraft/nano-key root lineage from prior SafeDep triage and external triage c1896; not decoded in this static pass.
View on MITRE ATT&CK