Loading malware…
ChromeStealer Exfiltrator is an exfiltration tool used by the APT group Mysterious Elephant. It is designed to harvest sensitive data from Google Chrome, specifically cookies, tokens, and other browser-stored information. Reporting also states that it can siphon files related to WhatsApp, aligning with the actor’s broader objective of stealing WhatsApp communications and associated artifacts. The malware has been observed in campaigns targeting government and foreign affairs entities in the Asia-Pacific region, with a strong focus on South Asia, including Pakistan, Bangladesh, Afghanistan, Nepal, and Sri Lanka. It is part of a wider Mysterious Elephant toolset that has been delivered in operations using spear-phishing, exploit kits, and malicious documents, with PowerShell-based staging and persistence also described in the same campaign context. High-confidence associations in the reporting tie ChromeStealer Exfiltrator directly to Mysterious Elephant’s data-theft operations focused on browser credentials/tokens and WhatsApp-related files.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
ChromeStealer Exfiltrator is a stealer malware that harvests cookies, tokens, and sensitive data from Google Chrome, and exfiltrates WhatsApp-related files.
Steals Chrome profile data (cookies/tokens and other artifacts) by collecting files from IndexedDB and Local Storage of the most recently used profile and uploading them to C2; C2 responses suggest interest in WhatsApp-related artifacts as well; uses string obfuscation.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.