For the first time, the ROKRAT sample used during the "North Korean Human Rights" contained a browser credentials stealer. The code used to perform this task in the same that found within in a Freenki sample deployed in 2016. The malware is able to extract the stored passwords from Internet Explorer, Chrome and Firefox. For Chrome and Firefox, the malware queries the sqlite database containing the URL, username and password: Additionally, they support the Microsoft Vault mechanism. Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer