H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Browser Information Discovery

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill) Browser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill) Browser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)

30 recorded

Relationships

mapped-to
from Footprinting
Technique
uses
from 3CX Supply Chain Attack
Campaign
uses
from APT38
Group
uses
from BeaverTail
Malware
uses
from Calisto
Malware
uses
from Chimera
Group
uses
from Cuckoo Stealer
Malware
uses
from DarkWatchman
Malware
uses
from Dtrack
Malware
uses
from Empire
Tool
uses
from Fox Kitten
Group
uses
from GlassWorm
Malware
uses
from Juicy Mix
Campaign
uses
from Kimsuky
Group
uses
from LightSpy
Malware
uses
from Lizar
Malware
uses
from Lumma Stealer
Malware
uses
from Machete
Malware
uses
from Mafalda
Malware
uses
from Mispadu
Malware
uses
from MobileOrder
Malware
uses
from Moonstone Sleet
Group
uses
from Operation AkaiRyū
Campaign
uses
from Outer Space
Campaign
uses
from PowerLess
Malware
uses
from RedLine Stealer
Malware
uses
from Scattered Spider
Group
uses
from SUGARDUMP
Malware
uses
from Troll Stealer
Malware
uses
from Volt Typhoon
Group
3 external

References

mitre-attack
T1217
open
Chrome Roaming Profiles
https://support.google.com/chrome/a/answer/7349337
open
Kaspersky Autofill
https://www.kaspersky.com/blog/browser-data-theft/27871/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance