Unix Security Audit & Intrusion Detection Tool
ID: 0f07c8b4-5301-5b05-84fe-df85edc52418
STIX ID: report--0f07c8b4-5301-5b05-84fe-df85edc52418
Feed Name: Darknet
DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool that extracts saved credentials, cookies, OAuth tokens, credit cards, autofill data and history from Chromium‑based and Firefox browsers; it bypasses Chrome App‑Bound Encryption by injecting a DLL into a headless Chromium process and using the IElevator COM interface to decrypt keys. The report covers supported browsers and encryption models (App‑Bound, DPAPI, NSS), operational evasion techniques (Early Bird APC injection, PPID/argument spoofing, API hashing), usage examples, detection opportunities, and mitigation recommendations for endpoint defenders.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
