Qilin ransomware targets Google Chrome credentials

Cyber crime and security vector concept showing a laptop, credit card and open padlock.
(Image credit: Shutterstock / Jozsef Bagota)

Sophos X-Ops uncovered a major breach involving Qilin ransomware, revealing a novel and alarming tactic involving the mass theft of credentials stored in Google Chrome browsers from compromised endpoints.

The Qilin ransomware group has been operational since at least 2022 and gained notoriety for its "double extortion" strategy. This method involves stealing a victim's data, encrypting their systems, and threatening to expose or sell the stolen data unless a ransom is paid.

This credential-harvesting technique poses serious risks beyond the immediate victims, highlighting the evolving nature of ransomware attacks.

Initial Access and Lateral Movement

In June 2024, Qilin ransomware attacked Synnovis, a UK governmental service provider for healthcare bringing the cybercrime group into the spotlight. The breach began with the attackers gaining access through compromised credentials for a VPN portal that lacked multi-factor authentication (MFA).

After 18 days of surveillance, the attackers moved laterally within the network to a domain controller. Here, they modified the Group Policy Objects (GPO) to introduce a PowerShell script named `IPScanner.ps1`, designed to harvest credentials stored in Chrome browsers.

This script was executed every time a user logged into their device, allowing the attackers to collect credentials from multiple devices connected to the network. The harvested data was stored in the SYSVOL share, named after the infected device's hostname, and was subsequently exfiltrated to the attackers' command-and-control server. After this data theft, the attackers deleted the local copies and cleared event logs to cover their tracks before deploying the ransomware payload.

Qilin ransomware targets Google Chrome, which holds over 65% of the browser market share. Therefore, the attackers could potentially access a vast array of usernames and passwords stored by users.

Organizations affected by this attack must reset all Active Directory passwords and advise users to change passwords for any sites saved in their browsers. The scale of the breach means that a single compromised account could lead to dozens or even hundreds of additional breaches across various services, significantly complicating response efforts.

Sophos researchers noted that this new approach could be a "bonus multiplier" for the chaos already inherent in ransomware situations. By harvesting credentials, Qilin and similar groups can gain insights into high-value targets, facilitating more sophisticated and damaging attacks in the future. This trend raises significant concerns about the security of organizations that may not be adequately prepared to defend against such multifaceted threats.

More from TechRadar Pro

Efosa Udinmwen
Freelance Journalist

Efosa has been writing about technology for over 7 years, initially driven by curiosity but now fueled by a strong passion for the field. He holds both a Master's and a PhD in sciences, which provided him with a solid foundation in analytical thinking. Efosa developed a keen interest in technology policy, specifically exploring the intersection of privacy, security, and politics. His research delves into how technological advancements influence regulatory frameworks and societal norms, particularly concerning data protection and cybersecurity. Upon joining TechRadar Pro, in addition to privacy and technology policy, he is also focused on B2B security products. Efosa can be contacted at this email: udinmwenefosa@gmail.com

Read more
A group of 7 hackers, 6 slightly blurred in the background and one in the foreground, all wearing black with hoods pulled up over their heads. You cannot see their faces. The hacker in the foreground sits with an open laptop in front of them. The background, behind the hackers, is a Chinese flag
China government-linked hackers caught running a seriously dangerous ransomware scam
ransomware avast
Billions of credentials were stolen from businesses around the world in 2024
Hands typing on a keyboard surrounded by security icons
Infostealers on the rise: the latest concern for organizational defenses
A person at a laptop with a cybersecure lock symbol floating above it.
Cybercrime gang targets victims with "triple threat" attacks
Concept art representing cybersecurity principles
How to combat exfiltration-based extortion attacks
Flags of Iran, China, Russia and North Korea on a wall. China North Korea Iran Russia alliance
Cybercrime is helping fund rogue nations across the world - and it's only going to get worse, Google warns
Latest in Pro
An image of network security icons for a network encircling a digital blue earth.
Why multi-CDNs are going to shake up 2025
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Millwall FC The Den
The UK's first football club mobile network is here - but you probably won't guess which team has launched it
Google Chrome
Google Chrome security flaw could have let hackers spy on all your online habits
Latest in News
inZOI promotional material.
inZOI has become the most wishlisted game on Steam, but I wouldn't get too caught up in the hype
Xbox Series X and Xbox wireless controller set to a green background
Xbox Insiders are currently testing a new Game Hub feature that looks useful, but I've got mixed feelings about it
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC
Oura Ring 4
Activity tracking on Oura Ring is about to get a whole lot better, but I've got bad news about your step count
Google Pixel Buds Pro 2
Cleaned your Pixel Buds Pro 2 recently? If not, you might be getting worse sound