The Qilin ransomware group has recently adopted a new tactic, deploying a custom stealer to harvest account credentials stored in the Google Chrome browser. This new tactic was observed in a ransomware attack where Qilin first gained access to a network via compromised credentials for a VPN portal that lacked multi-factor authentication (MFA). After eighteen (18) days of dormancy, likely used for reconnaissance and mapping the network, the attackers moved laterally to a domain controller. They modified Group Policy Objects (GPOs) to execute a PowerShell script designed to collect credentials stored in Chrome. This script was triggered every time a user logged into their machine, with stolen credentials saved to a shared location and then exfiltrated to Qilin’s command-and-control (C2) server. The attackers then wipe local copies and event logs to conceal their activities before deploying their ransomware payload to encrypt data across the compromised machines. The Qilin ransomware group’s shift towards credential harvesting in tangent with ransomware deployment highlights a potential for widespread credential theft across multiple platforms and services, significantly complicating the response to such an incident. Credential theft can provide attackers with a foothold for subsequent attacks or valuable information about high-value targets. This tactic could become a dark new chapter in the ongoing story of cybercrime, as it potentially opens doors to further exploitation by the attackers or other malicious actors. CTIX analysts recommend organizations enforce strict policies against storing sensitive credentials in web browsers and implement multi-factor authentication (MFA).