{"id":11329,"date":"2026-01-31T08:01:27","date_gmt":"2026-01-31T08:01:27","guid":{"rendered":"https:\/\/techtrendfeed.com\/?p=11329"},"modified":"2026-01-31T08:01:27","modified_gmt":"2026-01-31T08:01:27","slug":"tamecat-powershell-backdoor-targets-edge-and-chrome-login-credentials-at-danger","status":"publish","type":"post","link":"https:\/\/techtrendfeed.com\/?p=11329","title":{"rendered":"TAMECAT PowerShell Backdoor Targets Edge and Chrome: Login Credentials At Danger"},"content":{"rendered":"


\n<\/p>\n

\n

TAMECAT is a complicated PowerShell-based backdoor linked to APT42, an Iranian state-sponsored hacking group. <\/p>\n

It steals login credentials from Microsoft Edge <\/a>and Chrome browsers whereas evading detection. <\/p>\n

Safety researchers from Israel\u2019s Nationwide Digital Company detailed its modular design in current SpearSpecter marketing campaign evaluation.\u200b<\/p>\n

APT42 deploys TAMECAT in long-term espionage operations towards senior protection and authorities officers. <\/p>\n

\"Details
Particulars Of TAMECAT\u2019s capabilities (supply:Pulsedive)<\/figcaption><\/figure>\n

The group builds belief by social engineering earlier than compromising techniques. TAMECAT receives instructions by way of Telegram bots, downloading further scripts for duties like display screen captures and browser information theft, as reported <\/a>by Pulsedive.\u200b<\/p>\n

The an infection chain begins with a VBScript downloader (SHA256: 5404e39f2f175a0fc993513ee52be3679a64c69c79e32caa656fbb7645965422). This script scans for antivirus merchandise utilizing WMI queries. <\/p>\n

If \u201cHome windows\u201d seems within the AV listing, it launches PowerShell <\/a>by way of conhost with wget to fetch the loader from tebi[.]io. In any other case, it falls again to cmd.exe and curl for an alternate payload.\u200b<\/p>\n

Loader Evaluation<\/strong><\/h2>\n

The loader, nconf.txt (SHA256: bd1f0fb085c486e97d82b6e8acb3977497c59c3ac79f973f96c395e7f0ca97f8), makes use of AES-encrypted payloads. <\/p>\n

It defines Gorba for decryption with key \u201cT2r0y1M1e1n1o0w1\u201d and Borjol for additional processing. <\/p>\n

The script drops the primary three bytes from a base64 URL, downloads df32s.txt, and applies bitwise operations plus UTF-8 conversion to disclose extra code.\u200b<\/p>\n

Decrypted modules deal with sufferer ID era (written to %LocalAppDatapercentconfig.txt) and C2 communication to accurate-sprout-porpoise[.]glitch[.]me. <\/p>\n

\n
\"\"\/
Domains noticed by Israel\u2019s Nationwide Protection Company (Supply: pulsedive)<\/figcaption><\/figure>\n<\/div>\n

It collects OS particulars, pc identify, and a hardcoded token (GILNH9LX6TCZ9V8ZZSUF), encrypts by way of Borpos (AES-256, key: kNz0CXiP0wEQnhZXYbvraigXvRVYHk1B), and exfils by way of POST with customized \u201cContent material-DPR\u201d header for the IV.<\/p>\n

\u200b<\/p>\n

\"Data
Information manipulation code used to rework the encoded information (supply:Pulsedive)<\/figcaption><\/figure>\n

C2 responses, separated by \u00b6, embody language (PowerShell\/C#), base64 command, thread identify, and begin\/cease flags. <\/p>\n

TAMECAT executes these in-memory, suspending Chrome processes <\/a>and utilizing Edge\u2019s distant debugging for credential extraction.\u200b<\/p>\n

\n\n\n\n\n\n\n\n\n
Hash Sort<\/th>\nWorth<\/th>\n<\/tr>\n<\/thead>\n
SHA256 (VBS)<\/td>\n5404e39f2f175a0fc993513ee52be3679a64c69c79e32caa656fbb7645965422 \u200b<\/td>\n<\/tr>\n
SHA256 (Loader)<\/td>\nbd1f0fb085c486e97d82b6e8acb3977497c59c3ac79f973f96c395e7f0ca97f8 \u200b<\/td>\n<\/tr>\n
SHA1 (Loader)<\/td>\n0ef4f7a8d7b1d34e10faa0bca1dcb76a518dd417 \u200b<\/td>\n<\/tr>\n
MD5 (Loader)<\/td>\n081419a484bbf99f278ce636d445b9d8 \u200b<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

TAMECAT creates a Chrome listing in %LocalAppData% and targets saved logins. It leverages browser debugging protocols to dump credentials with out disk writes. <\/p>\n

\"Decrypted
Decrypted information(Supply: Pulsedive)<\/figcaption><\/figure>\n

Obfuscation contains array fragments, wildcards, and string alternative traits shared with PowerStar variants.\u200b<\/p>\n

Consumer-agent mimics Chrome 119: \u201cMozilla\/5.0 (Home windows NT 10.0; Win64; x64) AppleWebKit\/537.36\u2026\u201d. Platforms like Discord complement Telegram for C2 flexibility<\/a>.\u200b<\/p>\n

MITRE ATT&CK Mapping<\/strong><\/h2>\n