Credentials from Password Stores: Credentials from Web Browsers

ID: T1555.003
Tactics: TA0006 Credential Access
Sub-technique of: T1555 Credentials from Password Stores
Platforms: Linux, macOS, Windows
Data sources: File Access, Process Access, Process Creation
Source: attack.mitre.org
MITRE last modified: 12 Sep 2026

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.^[1] Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.^[2]

Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.^[3]^[4] Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager.

Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.^[5]

After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).

Detection

DET0037 Detect Suspicious Access to Browser Credential Stores
Data components: File Access, Process Access, Process Creation

Mitigations (5)

M1017 User Training: Provide user training on secure practices for managing credentials, including avoiding storing sensitive passwords in browsers and using password managers securely. Users should also be educated on identifying phishing attempts that could steal session cookies or credentials.
M1018 User Account Management: Implement strict user account management policies to prevent unnecessary accounts from accessing sensitive systems. Regularly audit user accounts to identify and disable inactive accounts that may be targeted by attackers to extract credentials or gain unauthorized access.
M1021 Restrict Web-Based Content: Restrict or block web-based content that could be used to extract session cookies or credentials stored in browsers. Use browser security settings, such as disabling third-party cookies and restricting browser extensions, to limit the attack surface.
M1027 Password Policies: Organizations may consider weighing the risk of storing credentials in web browsers. If web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in web browsers.
M1051 Update Software: Regularly update web browsers, password managers, and all related software to the latest versions. Keeping software up-to-date reduces the risk of vulnerabilities being exploited by attackers to extract stored credentials or session cookies.

Groups (24)

Software (67)

Showing 60 of 67. Full list on attack.mitre.org.