MalwareUsed by 1 actor

Browdec.exe

Browdec.exe is a Python-based browser credential theft tool associated with PoetRAT activity. Its documented purpose is to extract credentials stored in web browsers, indicating use as a focused credential-access component rather than a general-purpose remote access implant. The malware is used to harvest browser-saved secrets from compromised systems, supporting follow-on account compromise and broader intrusion objectives. Based on the available information, Browdec.exe is best characterized as a credential-stealing utility targeting browser-stored credentials on Windows systems. Publicly available information in this context does not establish additional capabilities, delivery mechanisms, or broader victimology with high confidence.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

PoetRAT

PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.

via mitre attack websiteattack.mitre.org

MITRE ATT&CK

Techniques & procedures

1 distinct technique documented for this family, organized by ATT&CK tactic.

Credential Access

1 technique

T1555.003Credentials from Web BrowsersEvidence4

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Credentials from Password Stores: Credentials from Web Browsers, Sub-technique T1555.003 - Enterprise | MITRE ATT&CK®

Python-based tool used to steal browser credentials.

mitre attack websiteNews

Mar 7, 2018

Credentials from Password Stores: Credentials from Web Browsers, Sub-technique T1555.003 - Enterprise | MITRE ATT&CK®

Python-based tool used to steal browser credentials.

mitre attack websiteNews

Mar 7, 2018

Credentials from Password Stores: Credentials from Web Browsers, Sub-technique T1555.003 - Enterprise | MITRE ATT&CK®

Python-based tool used to steal browser credentials.

mitre attackNews

Jan 25, 2026

Credentials from Password Stores: Credentials from Web Browsers, Sub-technique T1555.003 - Enterprise | MITRE ATT&CK®

Python-based tool used to steal browser credentials.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping1

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Browdec.exe