Kiosk Mode Attack: New Cyber Threat Steals Browser Credentials

OALabs researchers identified an active campaign where Amadey installs StealC and an AutoIt-based “Credential Flusher” that forces browsers into kiosk mode on legitimate sites (commonly Google login), coercing victims to re-enter credentials which are then captured by the stealer; the technique was first observed in late August and is reportedly gaining popularity among cybercriminals.