Common warning signs include repeated command line invocations, unexpected access to Chrome or Firefox credentials, use of /usr/bin/security against saved passwords, and processes reaching into the keychain. Crypto wallet targeting may also surface through suspicious extension access or attempts to collect wallet files. Endpoint detections should correlate these behaviors with unsigned binaries and suspicious disk images.
How to tell harvesting is happening, not just scanning
Active harvesting usually shows repeated, purposeful access patterns rather than a one-off probe. Look for command-line activity that keeps returning to browser credential stores, keychain material, or wallet-related files, especially when the process repeats the same lookups across a short window. The key question is whether the activity is clustered around secrets, not whether it merely touches the user profile.
On macOS, a common clue is the use of native tooling in an unusual sequence. Calls to /usr/bin/security, credential database queries, and process attempts to enumerate saved passwords or keychain items are more meaningful when they occur alongside script-like repetition, short-lived helper processes, or shell activity that does not fit the user’s normal workflow. Browser credential access can be equally telling when Chrome or Firefox stores are being read outside the expected browser process.
For wallet targeting, the signal is often broader than a single file read. Suspicious access to browser extensions, repeated reads of wallet directories, and attempts to locate wallet-related artifacts across multiple paths suggest collection behavior rather than ordinary application use. The more the process moves from discovery to systematic enumeration, the more likely it is actively harvesting data.
What process and file behavior most often exposes the infostealer
Process lineage matters. Infostealers frequently arrive through unsigned binaries, mounted disk images, or transient launch paths, then spin up child processes that touch the browser profile, keychain, or wallet material. A single suspicious binary is not always enough; the stronger signal is a binary that rapidly fans out into credential access, file discovery, and archive or exfiltration preparation.
File and API behavior also helps separate benign activity from theft. A process that reaches into saved passwords, reads browser credential stores, enumerates keychain records, or probes wallet files in quick succession is building a collection set. That pattern is especially concerning when the same host also shows archive creation, compression, staging in temporary locations, or network activity that follows the reads.
Endpoint telemetry should therefore be read as a chain, not a checklist. Command-line repetition, secret-store access, unsigned code execution, and suspicious disk-image use become more persuasive when they appear together on the same timeline. One isolated artifact can be noisy; several aligned artifacts usually indicate an active harvest phase.
Why browser, keychain, and wallet targeting deserve separate attention
Browser credentials, macOS keychain entries, and crypto wallet data are different targets with different consequences, so the analyst should not treat them as one generic “credential theft” event. Browser stores often expose session-bearing access to work and personal services, the keychain can contain high-value secrets and passwords, and wallet files can directly affect funds or signing authority. That means a single host event can create both account takeover risk and asset theft risk.
In practice, the most useful distinction is whether the activity is account-centric, secret-centric, or wallet-centric. If the process is reading browser stores and saved passwords, prioritize identity compromise paths. If it is probing keychain items directly, treat the exposure as broader secret theft. If wallet files or extension data are being enumerated, assume a higher likelihood of immediate monetization attempts and broader compromise of the user’s trusted environment.
Because the same stealer often targets all three, the defensive value comes from correlating them. A process that reads browser credentials and then the keychain is more significant than either behavior alone, and wallet collection on top of that is often a sign that the operator is maximizing post-compromise value before the host is cleaned up or rebooted.
Risk and Threat Considerations
Harvesting behavior is dangerous because the same malware family can quickly move from discovery to usable secrets. Once a stealer has browser credentials, keychain items, or wallet data, the attacker can often turn a local infection into account takeover, session reuse, or direct financial theft without needing to stay on the machine for long.
Failure mechanism: The malware abuses normal local access paths, credential helpers, and user-approved file locations to enumerate secret material faster than a human operator would. That makes the theft look like ordinary application activity unless telemetry correlates process repetition, secret-store access, and suspicious binary provenance.
Impact: The practical impact is credential loss, wallet compromise, and downstream access to cloud, email, source control, or financial accounts. If the harvested material is reused elsewhere, the original endpoint event can become a wider identity and fraud incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006 — Credential Access | The question centers on malware stealing browser, keychain, and wallet secrets. |
| TA0007 — Discovery | Harvester behavior includes enumerating browsers, keychains, and wallet files before theft. | |
| Recommendation — Map suspicious reads to credential-access techniques and hunt for follow-on exfiltration. Detect repeated secret-store and filesystem enumeration as discovery activity. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Harvested browser and keychain data often includes authenticators and reusable secrets. |
| SI-4 — System Monitoring | The answer depends on correlating process, file, and provenance telemetry for active theft. | |
| Recommendation — Rotate exposed authenticators and enforce lifecycle controls for any harvested secrets. Correlate endpoint telemetry to identify secret-harvesting behavior early. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Browser, keychain, and wallet harvesting is fundamentally secret leakage. |
| NHI-07 — Long-Lived Secrets | Stolen browser and keychain material often persists longer than intended and is reusable. | |
| Recommendation — Treat exposed browser, keychain, and wallet secrets as leaked material and rotate them. Shorten secret lifetime and revoke long-lived credentials that can be harvested. | ||
Practitioner Guidance
What to verify: Confirm whether the suspicious process actually touched secret-bearing paths, not just whether it ran. The most useful evidence is a timeline that shows command-line repetition, access to browser stores or keychain items, and a binary provenance problem such as unsigned execution or an unusual disk image.
Decision rule: If the process can read stored credentials or wallet material, treat the host as a credential-exposure event first and a malware event second. Containment should prioritise session revocation, secret rotation, and endpoint triage before you spend time proving full exfiltration.
Practitioner takeaway: The key judgement is correlation, not any single alert, because active harvesting is best identified when secret access, suspicious execution, and post-access staging all point to the same host and process.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
