Skip to content

Process memory scraping

Named by 2 kept items in this workspace.

Search every workspace for Process memory scraping. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Nx Console VS Code Extension Compromised
    writeup2026-06-02It is written here as Process memory scraping (T1003-like).

    Reads /proc/*/mem and pattern-matches for secrets, bypassing application-level secret masking, using: tr -d '\0' | grep -aoE '"[^"]+":{"value":"[^"]*","isSecret":true}' | sort -u

  • uk_daniel_card
    thread2026-05-13

    Stealing data from process memory, including monitoring browser RAM for credentials entered into text boxes in clear text

All techniques in this workspace.