Use Endpoint Detection and Response (EDR) tools that flag suspicious activities, such as a process suddenly reading browser password databases.