Credential Flusher Research

Description

This intelligence report describes a technique employed by threat actors to compel victims into entering their credentials into a browser, thereby enabling the credentials to be stolen from the browser's credential store using traditional credential-stealing malware. The method involves launching the victim's browser in kiosk mode and navigating to a login page, preventing the user from closing or navigating away from the webpage. This tactic frustrates the victim into entering their credentials in an attempt to close the window, after which the credentials are stored in the browser's credential store and can be exfiltrated.