MalwareUsed by 2 actors

ChromeKatz

ChromeKatz is an open-source browser credential-stealing tool focused on Google Chrome and other Chromium-based browsers. It extracts stored browser passwords and cookies, including by reading plaintext cookie material from Chromium process memory using browser-internal data structures. Stolen cookies can enable web-session hijacking, while recovered passwords support credential theft. ChromeKatz-style memory extraction has been reimplemented by multiple infostealer families to circumvent Chromium Application-Bound Encryption protections. China-linked Lotus Panda has deployed ChromeKatz alongside the CredentialKatz stealer during espionage operations against Southeast Asian organizations, including government, aviation, telecommunications, construction, media, and air-freight entities.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

StealC

Based on our analysis, the malware author appears to have reimplemented ChromeKatz within STEALC in order to bypass the app-bound encryption protection feature.

via elastic security labselastic.co

Lotus Blossom

Also deployed in the attacks are a reverse SSH tool, and two credential stealers ChromeKatz and CredentialKatz that are equipped to siphon passwords and cookies stored in the Google Chrome web browser.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

1 technique

T1622Debugger EvasionEvidence1

“VoidStealer is the first infostealer observed in the wild adopting a novel debugger-based Application-Bound Encryption (ABE) bypass technique that leverages hardware breakpoints to extract the v20_master_key directly from browser memory.”

Credential Access

3 techniques

T1003OS Credential DumpingEvidence2

STEALC calls ReadProcessMemory to access CanonicalCookieChrome structures from the Chrome network-service process. LUMMA uses NtReadVirtualMemory to locate chrome.dll and dump cookies in clear text.

T1539Steal Web Session CookieEvidence3

It is still possible of course to attempt obtaining the cookies via the browser's process memory dump or while injecting malicious code into the browser process, or by restarting the browser process with the remote debugging interface enabled.

T1555.003Credentials from Web BrowsersEvidence1

“ChromeKatz – Capable of stealing both credentials and cookies stored in Chrome; CredentialKatz – Capable of stealing credentials stored in Chrome”

Discovery

1 technique

T1622Debugger EvasionEvidence1

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

malware newsNews

Jul 31, 2026

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft - Malware News - Malware Analysis, News and Indicators

A credential-theft module/tool referenced as the basis for CornFlake’s browser credential theft capability and as an on-demand extraction function in the operator panel.

microsoft generalNews

Jul 31, 2026

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security Blog

A credential-theft module referenced as the basis for CornFlake’s browser credential theft capability and as a taskable extraction feature in the operator panel.

elastic security labsNews

May 30, 2025

Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns - Elastic Security Labs

An open-source browser credential/cookie extraction technique/tool whose logic was reimplemented in Rust by EDDIESTEALER to bypass Chromium protections and access unencrypted sensitive browser data.

elastic security labsNews

May 30, 2025

Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns

Open-source browser credential and cookie extraction tooling whose Chromium-focused logic was reimplemented by EDDIESTEALER.

+6 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ChromeKatz