WebBrowserPassView

WebBrowserPassView is a NirSoft credential-dumping utility used to extract usernames and passwords saved in web browsers on Windows systems. The provided content consistently describes it as a browser credential theft or password recovery tool that can dump browser-stored credentials, including via command-line execution and optional output to a file path specified with the /stext argument. It is also described as closed source, which limits easy modification compared with open-source alternatives such as LaZagne.

Across the cited reporting, WebBrowserPassView is used by multiple threat actors and intrusion sets as post-compromise credential access tooling. Kimsuky is repeatedly reported to have used NirSoft WebBrowserPassView to dump passwords from victims, including alongside malicious browser extensions used to steal passwords and cookies. Cisco Talos also reported its use in an intrusion at a Taiwanese government-affiliated research institute attributed with medium confidence to APT41, where the actor used WebBrowserPassView together with Mimikatz and other tooling to harvest credentials after initial access. Another Talos report describes a Kimsuky campaign in which a trojanized WebBrowserPassView v2.11 payload was injected to harvest browser credentials and write them to disk for later exfiltration. Additional reporting in the content states that Lazarus-linked activity downloaded, decrypted, and executed WebBrowserPassView to extract browser-related credentials and exfiltrate them with system information to a C2 server. The tool is also mentioned in ransomware and cybercrime intrusions, including Qilin affiliate activity and campaigns targeting trucking and logistics companies, where it was deployed after initial access for credential harvesting.

Behaviorally, the content ties WebBrowserPassView to browser credential dumping from fixed browser storage locations and to MITRE ATT&CK browser credential access activity. Detection-oriented reporting notes that successful extraction may not be reliably confirmed from logs unless the tool saves output to a file, and recommends monitoring process creation and file-access telemetry around browser credential stores. High-confidence indicators directly mentioned in the content include execution as WebBrowserPassView.exe and use of the /stext argument to write extracted credentials to a specified file.