MiniBrowse
MiniBrowse is a custom stealer designed for the theft of credentials in browsers and passwords stores. MiniBrowse was first observed in late-2025.[1] MiniBrowse has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
MiniBrowse has utilized HTTP POST requests for communications with C2.[1] |
| Enterprise | T1217 | Browser Information Discovery |
MiniBrowse has gathered browser data to include Edge login data.[1] |
|
| Enterprise | T1059 | .007 | Command and Scripting Interpreter: JavaScript |
MiniBrowse has leveraged JSON to exfiltrate data.[1] |
| Enterprise | T1555 | .003 | Credentials from Password Stores: Credentials from Web Browsers |
MiniBrowse has stolen credentials from Chrome and Edge browsers.[1] |
| Enterprise | T1041 | Exfiltration Over C2 Channel |
MiniBrowse has the ability to upload stolen data over C2 communications.[1] |
|
| Enterprise | T1559 | Inter-Process Communication |
MiniBrowse has sent JSON files to a named pipe.[1] |
|
| Enterprise | T1027 | Obfuscated Files or Information |
MiniBrowse has obfuscated code leveraging junk code insertion, control-flow obfuscation, opaque predicates, obfuscated function calls, and encrypted strings to hinder analysis.[1] |
|
| .013 | Encrypted/Encoded File |
MiniBrowse has encrypted strings that obfuscate code.[1] |
||
| .016 | Junk Code Insertion |
MiniBrowse contains obfuscated code leveraging junk code insertion.[1] |
||
| Enterprise | T1069 | .002 | Permission Groups Discovery: Domain Groups |
MiniBrowse has collected the domain associated with the victim system.[1] |
| Enterprise | T1033 | System Owner/User Discovery |
MiniBrowse has the ability to gather the username associated with the victim host.[1] |
|
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G1059 | NIMBUS MANTICORE |
MiniBrowse has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1] |