Two Thirds Of All Phishing Attacks Carried Out By Single Group

DumpBrowserSecrets is a publicly documented post‑exploitation tool that harvests credentials and session data from major Windows browsers (Chrome, Edge, Brave, Opera family, Vivaldi, and Firefox). It uses headless Chromium spawning and Early Bird APC DLL injection to leverage the IElevator COM interface and bypass Chrome's App‑Bound Encryption, retrieves DPAPI/NSS secrets where applicable, and outputs structured JSON; the report covers operational usage, evasion features, detection opportunities, and mitigation advice.