Removing the password-stealing Trojan hiding in your browser

Saved browser passwords have become a soft target for modern malware. A strain of Trojan built to harvest autofill credentials has been appearing on Windows and macOS machines across Australia, often piggybacking on fake courier notifications or compromised browser extensions. Unlike ransomware, this threat rarely makes noise; it quietly copies login strings for portals such as CBA, ANZ and Westpac and forwards them to a remote server.

The damage often surfaces later, when a customer in Brisbane or Perth opens online banking and finds an unfamiliar device session. Because the infection lives inside the browser and its helper processes, ordinary antivirus scans frequently miss it. A methodical approach — disconnect first, clean second, reset last — gives the best chance of a clean recovery.

This walkthrough follows that order. The steps assume a typical home PC on the NBN, but the same logic applies to a small-office workstation. For background on how credential stealers travel alongside other self-replicating threats, the worm analysis hub is a useful starting point.

How a browser-credential Trojan slips in

The most common delivery route is a phishing email impersonating Australia Post, Linkt or the ATO, with an attachment that drops a small loader. The loader pulls down the main payload, which hooks Chrome, Edge or Firefox so it can read anything the browser decrypts for autofill. A second route is a trojanised browser extension advertised through sponsored social-media posts.

Local ISPs such as Telstra, Optus and TPG block many known command-and-control servers, but operators rotate infrastructure quickly. Public Wi-Fi at cafés around Melbourne's CBD or in airport lounges in Sydney remains a frequent hunting ground, where victims are already authenticated to email and banking sites. Once installed, the Trojan often opens the door to other payloads, including worms that move through removable drives.

Warning signs your saved passwords are at risk

A few symptoms usually appear before real damage is done. Browser start-up becomes noticeably slower, the homepage or default search engine changes without your input, and unfamiliar extensions appear in the extensions list. Security emails from Westpac, CommBank or PayPal mention sign-ins from locations you have never visited.

Australia's cyber authorities encourage anyone seeing these signs to lodge a report through the Australian Cyber Security Centre's ReportCyber portal, even if no money has been lost. Banking apps let you view active sessions and terminate them remotely, a quick way to confirm whether stolen credentials have already been used.

Disconnect first, then protect what matters

Before opening any cleanup tool, unplug the network cable and switch off Wi-Fi. This stops the Trojan from receiving new instructions or uploading fresh credentials. If you have a trusted secondary device — a work laptop, a family member's iPad or a spare Chromebook — use it from now on to change passwords and reach help forums.

Back up only what you need: tax records, work files, family photos. Do not copy your browser profile, email archive or .pfx certificates, because the Trojan often hides inside those folders. If the system has been deeply compromised, a wipe and reinstall is safer than trusting a backup made after the infection.

Boot into Safe Mode and silence running threats

A Safe Mode boot loads Windows with only core drivers, which prevents most Trojans from starting. Hold Shift while clicking Restart, then choose Troubleshoot, Advanced options, Startup Settings and Restart. Press 4 for Safe Mode, or 5 for Safe Mode with Networking if you still need internet access.

Once inside, press Ctrl-Shift-Esc to open Task Manager and sort the Details tab by Publisher. Anything unsigned, running from AppData, Roaming or Temp, or named with random letters is suspicious. Right-click, choose End task, and note the full file path. You will delete those files later from an elevated Command Prompt or a bootable rescue environment.

Strip malicious extensions and clear browser data

Open each browser and visit its extensions page: chrome://extensions for Chrome, edge://extensions for Edge, or about:addons for Firefox. Remove anything you do not recognise, then clear browsing data including passwords, autofill, cookies and cached files, because any residue could be re-read by leftover hooks.

Comparing how the three major browsers store credentials and the cleanup path for each:

Browser	Password storage location	Native vault encryption	Extension revoke path
Chrome	Login Data file in User profile	Yes (Windows DPAPI)	chrome://extensions → Remove
Edge	Login Data file in User profile	Yes (Windows DPAPI)	edge://extensions → Remove
Firefox	logins.json + key4.db in profile	Yes (master password optional)	about:addons → Remove

Restart the browser after clearing. If a suspicious extension reappears, the Trojan is restoring itself through a scheduled task or Run key.

Run a deep scan and verify system integrity

With the browser closed, run a full offline scan with Windows Defender or a reputable tool such as Malwarebytes or ESET. An offline scan reboots the PC into a clean environment so rootkit components cannot hide. When the scan finishes, review every detection before deleting, in case the tool flags a work program by mistake.

Open Registry Editor and inspect HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM. Delete values pointing to files inside AppData, Roaming or Temp. In Task Scheduler, remove tasks that launch scripts with random names. For a deeper walkthrough of hidden persistence, read what to do when malware modifies your system files to stay hidden, which covers DLL hijacks and image-file execution options.

Reset credentials from a clean device and harden the browser

Change every important password from the trusted secondary device. Start with email, the recovery channel for everything else, then move on to banking, PayPal, MyGov and shopping accounts. Enable two-factor authentication on Australian banking apps to limit the damage if a password is still in circulation.

Finally, decide whether the browser should store passwords at all. Many users switch to a dedicated manager such as Bitwarden or 1Password and disable the browser's built-in vault. If you keep native storage, set a strong device password, turn on BitLocker on Windows or FileVault on macOS, and review saved logins regularly.

Cleanup and hardening checklist

Before reconnecting to the internet:

• Confirm the offline scan reports the system as clean and the extensions page stays empty after a restart.
• Apply pending operating-system updates so the browser and crypto libraries are current.
• Verify that no Run keys, scheduled tasks or startup folders still point to files in AppData or Temp.

Ongoing browser hygiene:

• Store recovery codes for two-factor accounts in a sealed envelope or safe, not in the browser you cleaned.
• Subscribe to the ACSC alert service so you hear about new credential-stealing campaigns targeting Australians.
• Avoid reusing passwords across shopping, banking and email accounts; a password manager makes this practical.