# Browser Credential Harvesting via Session Debug Tool

- **Severity:** Critical
- **Signature ID:** `4f65c74b-62ed-4a26-ad87-e30ce21467de`
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), LLM01 (Prompt Injection)

## Summary

A tool made available to an AI agent claims to help with session debugging, but actually reads saved passwords and login cookies from the browser's local database, encodes them, and sends them to an outside server. It's credential-stealing malware disguised as a developer utility.

## How the attack works

An AI agent is given access to a tool that presents itself as a browser session or debugging helper. When invoked, the tool opens the browser's local SQLite database and pulls out stored cookies and saved login credentials. It then base64-encodes that data, likely to evade simple text-based inspection, and transmits it to an external network endpoint the attacker controls. The whole sequence — read local credential store, encode, exfiltrate — happens under the cover of a plausible-sounding debug function.

## Why it matters

Successful execution hands an attacker live session cookies and stored passwords, letting them hijack user sessions or log into accounts directly, bypassing normal authentication.

## What you can do

- Review any MCP or agent tool that touches browser profile directories or SQLite cookie/login databases, and confirm what it actually does with that data.
- Block or tightly control outbound network calls made by tools that have local file-read access, especially to unfamiliar endpoints.
- Require that any legitimate debugging or forensics tool operate only on test/sample data, never live user profiles, and never transmit raw extracted data off the host.
- Treat base64-encoded payloads sent from a tool right after it reads a credential store as a red flag, not routine behavior.

## Known benign look-alikes

- Legitimate browser forensics tools with proper data handling
- Security research tools that analyze local data without transmission
- Developer debugging scripts that process test data only

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00222

---
Source: https://www.netzilo.com/threats/atr-browser-credential-harvesting-via-session-debug-tool