MiniBrowse
MiniBrowse is a lightweight credential-stealing malware family associated with the Iran-linked threat actor Nimbus Manticore, which overlaps with tracking names including UNC1549 and Smoke Sandstorm; related reporting also places it within Tortoiseshell-linked tooling. It is used in cyber-espionage campaigns targeting aerospace, defense manufacturing, telecommunications, aviation, satellite, airline, and other high-value organizations in the Middle East and Western Europe, including reported focus on Denmark, Sweden, Portugal, Israel, and the UAE. MiniBrowse is deployed alongside the MiniJunk backdoor in recruitment-themed spear-phishing operations that impersonate companies such as Boeing, Airbus, Rheinmetall, and flydubai. Victims are directed to fake career portals with unique URLs and credentials, which deliver malicious ZIP archives. The broader infection chain uses DLL sideloading and hijacking via legitimate Windows executables; MiniBrowse is specifically described as being delivered as an injected DLL. MiniBrowse has separate variants targeting Google Chrome and Microsoft Edge. Its primary function is to steal stored browser credentials and related login files. Reported behavior includes collecting system identifiers, sending victim identifiers to a predefined C2 endpoint, exfiltrating browser login-related files via HTTP POST, and exfiltrating data in JSON payloads to command-and-control servers. It also uses named pipes for internal communication. One report states MiniBrowse proceeds with browser credential theft when its C2 server responds with an HTTP status other than 200. The malware is described as optimized for stealth and avoiding security alerts, and reporting notes that MiniBrowse samples used heavy compiler-level obfuscation, including junk code insertion and encrypted strings. No standalone IOCs specific to MiniBrowse were provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MiniBrowse is a lightweight stealer used by Nimbus Manticore. We observed two variants, one to steal Chrome credentials and another which targets Edge.
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniquesThe campaign employs highly targeted spear-phishing, impersonating HR recruiters from reputable organizations like Boeing, Airbus, and Rheinmetall. Victims receive personalized phishing emails with unique URLs and credentials directing them to fraudulent career portals built on React templates.
These portals, often hosted behind Cloudflare to mask server IPs, deliver malicious ZIP archives disguised as legitimate software.
The threat actor uses tailored spear‑phishing from alleged HR recruters directing victims to fake career portals.
Execution
2 techniquesPrivilege Escalation
1 techniqueStealth
4 techniquesThe tools continuously evolve to remain covert, leveraging valid digital signatures, inflate binary sizes, and use multi-stage sideloading and heavy, compiler‑level obfuscation
The threat actor impersonates local and global aerospace, defense manufacturing, and telecommunications organizations.
Defense Impairment
1 techniqueTo bolster stealth, Nimbus Manticore signs its malware with certificates from SSL.com, reducing detection rates.
Credential Access
3 techniquesBoth versions are DLL designed to be injected into browsers to steal the stored passwords.
In parallel, hackers deploy MiniBrowse, a lightweight credential stealer targeting Chrome and Edge browsers. Delivered as an injected DLL, MiniBrowse extracts stored passwords.
Additionally, Nimbus Manticore deploys MiniBrowse, a lightweight stealer targeting Chrome and Edge browser credentials.
Discovery
4 techniquesThe backdoor then collects two identifiers from the infected system: the computer name and the domain name with the username.
The backdoor then collects two identifiers from the infected system: the computer name and the domain name with the username.
For discovery, system information discovery (T1082) and file and directory discovery (T1083) have been the most prevalent methods used to map the environment.
Collection
1 techniqueThe infection chain begins with a ZIP archive file - it was named Survey.zip in a sample analyzed by Check Point - which contains a legitimate Windows executable, Setup.exe, that sideloads a malicious userenv.dll.
Command and Control
1 techniqueThe backdoor uses regular HTTPS requests using the Windows API.
Exfiltration
1 techniqueAfter parsing the command, in this case, the backdoor sends the file from the specified path via several network requests, based on the chunk size provided as an argument.
IOCs tracked for this family
47 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Part of Tortoiseshell’s modular framework, likely used for browser data harvesting as stated in the surrounding description.
Lightweight credential stealer used by Nimbus Manticore to target Chrome and Edge browser credentials, collect system identifiers, and exfiltrate data to C2 servers using JSON payloads and named pipes.
MiniBrowse is a lightweight stealer malware with versions targeting Chrome and Edge browsers to steal credentials, used by the Nimbus Manticore group.
Information-stealing component/tool used by Nimbus Manticore, focused on covert collection/exfiltration of sensitive data while evading security alerts.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.