A new Google Chrome password stealer called CStealer uses a remote MongoDB database to store the data it’s collected.

In its coverage of the Chrome password stealer, Bleeping Computer reported that CStealer’s data exfiltration technique diverts from similar malware. The threat did not compile a user’s login credentials stolen from Google Chrome’s password manager into a file and send it to a command-and-control (C&C) server. Instead, it arrived with hardcoded MongoDB credentials and leveraged the MongoDB C Driver to remotely connect and exfiltrate its stolen data to a database.

Bleeping Computer noted that this method effectively serves the purpose of exfiltrating stolen Chrome passwords. But the security firm observed that this data exfiltration technique brings additional risk to affected users’ data security. It attributed this risk to the fact that anyone ranging from law enforcement officers to secondary attackers can retrieve CStealer’s hardcoded credentials and use them to access the MongoDB database, thereby further exposing victims’ data.

A Look at Other Chrome Password Stealers

CStealer isn’t the only Chrome password stealer that’s attracted the attention of security researchers in recent years. Back in November 2017, Cofense discovered that the Vulture Stealer had paired the Banload banking Trojan with a secondary stealer to target victims’ Google Chrome data.

Less than a year later, Proofpoint detected a campaign in which the Vega Stealer attempted to steal the Chrome and Firefox data of employees. In August 2019, CyberArk Labs spotted a threat using a clever technique to evade detection while targeting user’s Google Chrome information.

How to Defend Against Threats Like CStealer

Security professionals can defend against threats like CStealer by building a modern identity and access management (IAM) program that supports security best practices as their organizations migrate more of their services to the cloud. Companies should also seek to use artificial intelligence (AI)-driven solutions and automated monitoring tools to improve their visibility of the network so that they can watch for behavior that could be indicative of a threat attempting to exfiltrate data.

More from

When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule

In February 2023, X-Force posted a blog entitled “Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers” that details the capabilities of a sample attributed to the Lazarus group leveraged to impair visibility of the malware’s operations. This blog will not rehash analysis of the Lazarus malware sample or Event Tracing for Windows (ETW) as that has been previously covered in the X-Force blog post. This blog will focus on highlighting the opportunities for detection of the FudModule within the…

LastPass Breaches Cast Doubt on Password Manager Safety

In 2022, LastPass suffered a string of security breaches which sparked concern among cyber professionals and those impacted by the intrusions. Some called into question the way LastPass handled and responded to the incident. In addition, the situation ignited a wider conversation about the risks linked to utilizing password managers.A password manager helps users generate strong passwords and safeguards them within a digital locker. A master password secures all data, which enables users to conveniently access all their passwords for…

The Role of Finance Departments in Cybersecurity

Consumers are becoming more aware of the data companies collect about them, and place high importance on data security and privacy. Though consumers aren’t aware of every data breach, they are justifiably concerned about what happens to the data companies collect. A recent study of consumer views on data privacy and security revealed consumers are more careful about sharing data. The majority of respondents (87%) say they wouldn’t do business with companies that appear to have weak security. Study participants also…

The One Place IT Budget Cuts Can’t Touch: Cybersecurity

If IT spending is slowing, will business leaders follow a similar approach for cybersecurity budgets? Probably not. Gartner predicts that end-user spending on both security technology and services will see an annual growth rate of 11% over the next four years. And the market is anticipated to reach $267.3 billion in 2026. Many security professionals agree that security spending cuts aren’t likely. Given the current threat landscape, strong security has quickly become a business imperative. Security has become the highest…