{
  "family": "browserpassview",
  "sample_count": 2,
  "category": "trojan",
  "description": "HackTool:Win32/Browserpassview is a heuristic detection for a specific utility created by NirSoft (BrowserPassView.exe). While legitimately created for system administrators to recover lost passwords, in the context of enterprise security, this tool is overwhelmingly abused by threat actors and malware as a highly effective credential dumping utility (`T1003.001`). It is designed to instantly extract saved passwords, usernames, and URLs from all major web browsers installed on a system.<br><br><b>Understanding Browserpassview (Credential Stealing)</b><br>To an end-user, the execution of this tool is entirely invisible. For a security operations center (SOC), the detection of Browserpassview is a critical alert indicating a severe credential compromise. Threat actors drop this tool via initial access trojans or deploy it during lateral movement to rapidly harvest saved corporate passwords, VPN credentials, and personal accounts.<br><br><b>Execution and Extraction Mechanics</b><br>Attackers typically deploy Browserpassview via command-line execution (`T1059.003`), often passing specific arguments to force the tool to silently dump the extracted credentials directly into a text file (e.g., `browserpassview.exe /stext c:\\temp\\passwords.txt`). The tool works by directly accessing the internal databases and credential stores used by Chrome (SQLite databases encrypted with DPAPI), Firefox (key3.db/logins.json), Edge, and Opera. By running under the context of the logged-in user, it utilizes the Windows Data Protection API (DPAPI) to seamlessly decrypt the stored passwords without requiring any interaction (`T1555.003`). The resulting text file is then quickly exfiltrated by the attacker.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the immediate, total compromise of all credentials saved in the user's web browsers, leading to massive lateral movement and data theft. Host-based IoCs include EDR alerts for the execution of the `browserpassview.exe` binary, or similarly named files, often spawned by an unauthorized process (like a macro-enabled Word document or a PowerShell script). A highly specific IoC is the command-line execution containing arguments like `/stext`, `/shtml`, or `/sxml` pointing to a temporary directory. File integrity monitoring may detect the sudden creation of plaintext files containing lists of URLs and passwords.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1003.001",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers (The core function of the tool)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory (Often used in conjunction with this tool for full credential theft)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Executing the tool silently via CLI)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; assume all credentials stored in the user's browsers (including corporate SSO, VPN, and personal accounts) are fully compromised.",
    "Initiate an emergency, mandatory password reset for the affected user across all corporate systems and services.",
    "Analyze EDR telemetry to trace the parent process that launched the tool to identify the initial access vector (e.g., a phishing payload).",
    "Review network logs (Proxy/DNS) to identify where the dumped credential file was exfiltrated (e.g., FTP upload or HTTP POST)."
  ],
  "what_to_avoid": [
    "Do not assume the attack stopped with browser credentials; attackers almost always deploy additional tools to dump LSASS (Mimikatz) concurrently.",
    "Avoid allowing users to save corporate passwords in web browsers; enforce the use of enterprise-managed, encrypted password managers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}