Malware Writers Using Exclusion Lists To Linger

DumpBrowserSecrets is a Windows post‑exploitation tool (released by Maldev Academy) that harvests browser-stored secrets — saved credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries, and history — from Chromium-based and Mozilla browsers. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL via Early Bird APC to use the IElevator COM interface, includes DPAPI and NSS handling for other browsers, and incorporates evasion features to reduce EDR detection; output is structured JSON for operator use.