: Saved passwords, cookies, and autofill credit card info from Chrome, Edge, and Firefox.
: Upon extraction and execution, the malware often copies itself to the %AppData% or %LocalAppData% folders and creates a Scheduled Task or Registry Run Key to ensure it starts with Windows. Anomaly_OB Updated.rar
: If executed, disconnect the device from the internet to stop data exfiltration. : Saved passwords, cookies, and autofill credit card