NMAP 4.20 released
ID: 1213f1df-f94d-5999-9411-d59db031d7d5
STIX ID: report--1213f1df-f94d-5999-9411-d59db031d7d5
Feed Name: Darknet
DumpBrowserSecrets is a publicly available post-exploitation tool that harvests browser-stored credentials and session data from major Chromium- and Gecko-based browsers. It implements an App-Bound Encryption bypass for Chrome/Edge/Brave by injecting a DLL into a headless Chromium process via Early Bird APC and using the IElevator COM interface to decrypt keys, handles DPAPI and NSS decryption for other browsers, and includes operational evasion features; the output is structured JSON suitable for red team or adversary use.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
