{
  "family": "chromepass",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Chromepass is a highly specific utility categorized as a Credential Dumper. While it can technically be used legitimately to recover forgotten passwords, it is overwhelmingly utilized by threat actors, embedded within larger info-stealer malware, or executed during hands-on-keyboard attacks to systematically extract all saved passwords from the Google Chrome web browser.<br><br><b>Understanding Chromepass (Credential Dumping)</b><br>To an end-user, this tool operates silently; they will not know their passwords have been stolen until their accounts are compromised. For a SOC analyst, the execution of Chromepass is a severe incident indicating that an attacker has gained execution privileges on the endpoint and is actively harvesting credentials (`T1003.001`) to facilitate lateral movement or data theft.<br><br><b>Execution and Extraction Mechanics</b><br>Google Chrome stores saved usernames and passwords in a local SQLite database file (typically located at `%LocalAppData%\\Google\\Chrome\\User Data\\Default\\Login Data`). The passwords within this database are encrypted using the Windows Data Protection API (DPAPI), which ties the encryption key to the currently logged-in Windows user's credentials. Chromepass operates by programmaticly interacting with the DPAPI (`T1555.003`). Because the attacker executes Chromepass within the context of the logged-in user, the tool simply requests Windows to decrypt the database. It then parses the SQLite file and outputs a cleartext list of URLs, usernames, and passwords.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of all web credentials saved in the user's browser, potentially leading to unauthorized access to corporate SSO portals, email, and financial accounts. Host-based IoCs include EDR alerts for 'Suspicious Credential Dumping Activity' or processes attempting to unexpectedly read the `Login Data` SQLite file. Command-line logging (Event ID 4688) may capture the execution of known Chromepass binaries or PowerShell scripts interacting with the `CryptUnprotectData` API.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Chromepass and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Chromepass is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Chromepass establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Chromepass typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Chromepass compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Chromepass should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Chromepass leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Chromepass frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Chromepass maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Chromepass often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1555.003",
    "T1059.001",
    "T1003.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers (Targeting Chrome's Login Data)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory (Often used in conjunction to bypass DPAPI protections)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Execution method)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Mandate an immediate password reset for the compromised user, covering ALL corporate accounts and services they access.",
    "Force a session token revocation for the user across all SaaS applications and internal portals (e.g., Microsoft 365, Okta, VPN).",
    "Isolate the endpoint to prevent the extracted credentials from being used for immediate lateral movement.",
    "Analyze EDR telemetry to determine how Chromepass was executed (e.g., dropped by an info-stealer, or run manually via a reverse shell)."
  ],
  "what_to_avoid": [
    "Do not assume only the 'work' passwords were stolen; attackers will use personal credentials to access bank accounts and personal email.",
    "Avoid relying solely on file hashes to detect this tool; the extraction logic can easily be compiled into custom, evasive scripts."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}