ChromePass

ChromePass is a public utility that is meant to help users recover passwords from instances of the Google Chrome Web browser, as well as from other browsers based on the Chromium project. Unfortunately, while this tool is meant to be helpful, it often may be misused by various cybercriminals, including high-profile threat actors like the Cycldek Advanced Persistent Threat (APT) group. The Cycldek hackers have employed ChromePass in multiple attacks against government entities and individuals in Southeast Asia.

ChromePass stores the collected data in an HTML file on the compromised host. The tool does not have the ability to exfiltrate the file to a remote location, so it is likely that the Cycldek hackers are using other malware tools to transfer the file from the infected host to the Command and Control server.