A new Google Chrome password stealer called CStealer uses a remote MongoDB database to store the data it’s collected.
In its coverage of the Chrome password stealer, Bleeping Computer reported that CStealer’s data exfiltration technique diverts from similar malware. The threat did not compile a user’s login credentials stolen from Google Chrome’s password manager into a file and send it to a command-and-control (C&C) server. Instead, it arrived with hardcoded MongoDB credentials and leveraged the MongoDB C Driver to remotely connect and exfiltrate its stolen data to a database.
Bleeping Computer noted that this method effectively serves the purpose of exfiltrating stolen Chrome passwords. But the security firm observed that this data exfiltration technique brings additional risk to affected users’ data security. It attributed this risk to the fact that anyone ranging from law enforcement officers to secondary attackers can retrieve CStealer’s hardcoded credentials and use them to access the MongoDB database, thereby further exposing victims’ data.
A Look at Other Chrome Password Stealers
CStealer isn’t the only Chrome password stealer that’s attracted the attention of security researchers in recent years. Back in November 2017, Cofense discovered that the Vulture Stealer had paired the Banload banking Trojan with a secondary stealer to target victims’ Google Chrome data.
Less than a year later, Proofpoint detected a campaign in which the Vega Stealer attempted to steal the Chrome and Firefox data of employees. In August 2019, CyberArk Labs spotted a threat using a clever technique to evade detection while targeting user’s Google Chrome information.
How to Defend Against Threats Like CStealer
Security professionals can defend against threats like CStealer by building a modern identity and access management (IAM) program that supports security best practices as their organizations migrate more of their services to the cloud. Companies should also seek to use artificial intelligence (AI)-driven solutions and automated monitoring tools to improve their visibility of the network so that they can watch for behavior that could be indicative of a threat attempting to exfiltrate data.