HackBrowserDataMalware
Browser information stealer, written in Go.From MISP Galaxy
Last reported 16 days ago, by The Hacker News4 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1056.001Keylogging
“InvisibleFerret supports functions such as remote control, data exfiltration, browser stealing capabilities, and keylogging.”
- T1059.009Cloud API
“api.camdriverhub.cloud api.camdrivers.cloud”
- T1110Brute Force
“The report shows that the primary causes of database server attacks include not only the exploitation of vulnerabilities but also brute-force and dictionary attacks, as well as improper account management.”
- T1505.003Web Shell
“It also describes, through actual attack cases, the patterns in which web shells, backdoors, CoinMiner, and VPN tools are used in combination.”
- T1665Hide Infrastructure
“…has revealed active use of Amazon Web Services (AWS) for hosting malicious assets, and Cloudflare services have been leveraged to hide infrastructure fingerprints and impede analysis.”
- T1684Social Engineering
“Phishing Awareness: Conduct regular employee training on recognizing and reporting phishing and social engineering attempts.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm“It also drops the HackBrowserData binary, exfiltrates the collected data, establishes persistence on the host, and facilitates the execution of remotely-supplied code.”
-
Q3 2026 Statistical Report on Malware Targeting Windows Database Servers“The threat actor attempted to engage in credential theft using the reg save HKLM\SYSTEM command and also utilized HackBrowserData (a tool for stealing browser-stored information), Fscan (an internal network scanner), and Cloudflared (a tool for exposing local ports).”
-
Lazarus ClickFake Interview Campaign: ClickFix Malware“It is designed for Windows and macOS with Chrome browser stealer capabilities based on the HackBrowserData project.”
-
Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025“HackBrowserData”
Indicators in its reports
named in the reports above- hxxps://www.archblock[.]comin 1 report
- www.archblock[.]comin 1 report
- all[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiadrivers-kp9s.updatein 1 report
- api.smartdriverfix[.]cloudin 1 report
- scenarios[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/coremedia-kp9s.shin 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiawins-updatein 1 report
- driverpackx[.]appin 1 report
- process.parent[.]pidin 1 report
- vid-crypto-assess[.]comin 1 report
- assessiohq[.]comin 1 report
- blockassess[.]comin 1 report
- blockchainjobassessment[.]comin 1 report
- blockchainjobhub[.]comin 1 report
- candidateinsightinfo[.]comin 1 report
- coinbase-walet[.]bizin 1 report
- coinbase-walet[.]mein 1 report
- competency-core[.]comin 1 report
- devchallengehq[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.