Browser Credential Harvesting via Session Debug Tool - ATR-2026-00222 (3945c92e-5dae-5304-9e3a-9a6ce641fc0c)
Detects MCP tools that extract browser cookies and login credentials from local SQLite databases, encode them in base64, and transmit to external endpoints. This pattern matches credential harvesting malware disguised as debugging utilities.