For the first time, the ROKRAT sample used during the "North Korean Human Rights" contained a browser credentials stealer. The malware is able to extract the stored passwords from Internet Explorer, Chrome and Firefox. For Chrome and Firefox, the malware queries the sqlite database containing the URL, username and password: Additionally, they support the Microsoft Vault mechanism. Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer. Here is the initialization of the Vault APIs: On the left, we have the ROKRAT sample and on the right the FreeMilk sample