Netcrook
#browser data
Inside the Browser: When Extensions Turn Into a Theft and Lure Layer
Multiple Chrome and Edge extensions were linked to a malware framework that targeted crypto, browser data, and history, showing how trusted add-ons can become stealthy in-session threats.
When Malware Finds a Shortcut Through Ethereum
GoCaracal pairs interactive post-compromise features with a blockchain-based lookup for a replacement command address, making takedown work harder for defenders.
MacSync’s Moving Target: Why One macOS Stealer Can Be Harder to Kill Than to Find
A macOS infostealer built around rotating domains shows how stolen credentials, browser data, and SSH material can become a durable theft pipeline if defenders only chase one hostname at a time.
When a Skill Registry Becomes the Front Door for Stealers
A campaign tied to ClawHavoc turns an AI extension ecosystem into a high-value theft path, with wallets, SSH keys, browser data, and AWS credentials in the crosshairs.
When a Mac Stealer Wants Your Session, Not Your Password
AmnesiaStealer is a Rust-built macOS infostealer that targets stored credentials and browser state, a combination that can turn stolen data into reusable access.
Remus Steals the Easy Way In, Then Hides Its Command Server in Ethereum
A new malware campaign uses SEO-poisoned cracked-software lures and an Ethereum smart contract to conceal its command server while stealing browser and account data.
When a Mac Stealer Learns Your Secrets, the Crypto Raid Can Happen Later
A macOS-focused information stealer detected by MistEye is reported to collect wallet databases, Keychain material, browser data, and Apple Notes, then use those fragments for offline cryptocurrency theft attempts.
The Quiet Theft Model: How a Rust Infostealer Turns Browser Trust Into Account Risk
KuinaExtractor, a reported Rust-based infostealer also linked to the name k0to, highlights a familiar but dangerous pattern: steal the browser state, and you may steal the session.
The Sandbox Stops Guessing: Browser-Level Inspection Pushes Phishing Triage Deeper
ANY.RUN has added in-browser data inspection to its Interactive Sandbox, a move that targets the runtime tricks behind redirect-heavy phishing pages and post-load DOM changes.
Browser Theft, Packaged Like Software: The OnyxC2 Playbook
A newly surfaced stealer shows how credential theft is being sold as a subscription business, with a web panel, a builder, and Cloudflare-fronted infrastructure.
Mac’s Trusted Tools Become the Trap in a New SHub Stealer Push
A reported macOS stealer called Reaper pairs fake app download pages with a ClickFix-style script launch, putting browser data and crypto wallets in the crosshairs.
Chrome’s Protected Memory Isn’t the Finish Line for Infostealers
VoidStealer is a reminder that browser hardening can still be undercut when malware waits for secrets to appear in memory, where encryption no longer helps.