First Malicious iPhone Worm In The Wild

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool that extracts passwords, cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from major Chromium‑based and Firefox browsers on Windows. It bypasses Chrome's App‑Bound Encryption (Chrome 127+) by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface to decrypt the app_bound_encrypted_key, supports DPAPI and NSS decryption for other browsers, includes evasion features (string obfuscation, API hashing, PPID/argument spoofing, file handle duplication), outputs structured JSON, and is positioned as a red team tool with clear implications for lateral movement and cloud account takeover if executed on compromised developer workstations.