The new Macbook Pro 15″ 2.0Ghz taken apart
ID: 0b869001-12a2-54d0-afbf-b12b86d3589e
STIX ID: report--0b869001-12a2-54d0-afbf-b12b86d3589e
Feed Name: Darknet
DumpBrowserSecrets is a post-exploitation credential-harvesting tool for Windows that extracts saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, history, and bookmarks from major browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox). It implements an App‑Bound Encryption bypass for Chromium-based browsers by spawning a headless Chromium process and injecting a DLL via Early Bird APC to call the IElevator COM interface, retrieves DPAPI or NSS keys where applicable, includes operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), outputs structured JSON, and is positioned for red-team assumed-breach scenarios while also outlining detection and mitigation strategies.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
