oxide-stealer

Standalone credential extraction tool for the oxide security research framework.

Lab use only. Test against test credentials in isolated VMs only. See DISCLAIMER.md.

---

What It Extracts

Source	Data
Chromium-family (Chrome, Brave, Edge)	Login credentials, cookies
Firefox	Login credentials, cookies
SSH private keys	~/.ssh/id_* enumeration

Build

cargo build --release

Usage

./target/release/oxide-stealer           # JSON to stdout
./target/release/oxide-stealer --zip /tmp/results.zip
./target/release/oxide-stealer --no-ssh  # skip SSH enumeration

Integration with oxide

Upload binary to the oxide panel (no stage_number) via /api/staging/upload. Click Steal in the panel. The implant downloads, validates SHA-256, and executes the stealer as a subprocess.

Detection

detection/
├── yara/    oxide_stealer.yar
├── sigma/   chromium_cred_access_linux.yml, firefox_cred_access_linux.yml,
│            chromium_cred_access_windows.yml, firefox_cred_access_windows.yml,
│            exfil_staging_zip.yml
├── logging/ auditd-cred.rules, sysmon-credential-access.xml
└── ir/      PLAYBOOK.md, INDICATORS.md

ATT&CK: T1555.003, T1552.004.

---

Related

• oxide - Implant + C2 panel
• oxide-loader - 3-stage delivery chain
• oxide-infra - Lab infrastructure (Terraform + Ansible)