Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a publicly released post-exploitation tool that harvests credentials and session artifacts from major browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox). It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process, injecting a DLL via Early Bird APC to call the IElevator COM interface and decrypt the app_bound_encrypted_key, and it retrieves DPAPI and NSS-protected data for other browsers; output is written as structured JSON. The report describes technical operation, evasion features (string obfuscation, API hashing, PPID/argument spoofing, file-handle duplication), an attack scenario demonstrating rapid extraction of OAuth tokens and cookies for cloud account takeover, and detection/mitigation guidance for defenders.