Browser Automation Toolkit Session Credential Harvest
This detects a specific attack pattern: an AI agent session that controls a web browser (Chrome, Edge, Firefox, etc.) and then, from a separate non-browser process in that same session, reads the browser's saved passwords or login cookies. That combination turns an ordinary browsing capability into credential theft.
How the attack works
An AI agent uses a browser-automation tool to control a real browser over an HTTP interface, similar to legitimate tools like the ai-browser-toolkit package. In the same working session, a different process—not the browser itself—reads the browser's credential store, such as its cookie database or saved-login file. Optionally, the harvested data is then sent out over the network or written to a staging location. The detection ties all of this together by tracing the exact process and its spawned children in one session, not by loosely matching activity across different sessions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7b3c1e9a-4d52-4f18-9c60-2a8e5d31b7f4
- Severity
- High
Why it matters
If this pattern reflects malicious intent, an attacker can obtain a user's live authenticated sessions and stored passwords for whatever sites the browser was logged into, enabling account takeover without needing the user's actual password.
What you can do
- →Restrict which processes can access browser profile directories (cookies, login data, session storage) outside the browser process itself.
- →Review any agent workflow that combines browser automation with file-reading capability, and confirm the reason it needs access to credential stores.
- →If an alert fires, check whether the access was a legitimate profile clone for session reuse versus data being written out or sent externally.
- →Limit agent sessions' network egress so that even if credentials are read, they cannot easily be exfiltrated.
Known benign look-alikes
- Browser-automation toolkits that intentionally clone the user's real Chrome/Edge profile (User Data/Default, Cookies, Login Data) into a temporary profile so the agent can reuse an authenticated session. This is the primary benign case for this exact package. It is reported, not blocked, and the reason string states whether an egress stage was observed (profile-clone alone produces only the staging stage).
- A developer inspecting their own browser cookie database with sqlite3, python or a notebook inside an agent-driven terminal while a headless browser is running.
- Backup, migration or profile-sync utilities launched from the same shell session as the agent within the 10 minute correlation window.
- Session-recovery or crash-reporting helpers that are not matched by the browser process exclusion list (renamed or vendored browser binaries).