logo

ProxyBlob – SOCKS5 Over Azure Blob Storage for Covert Network Tunneling

ID: 12874c0e-c769-5eff-bd96-cd50f3331bc4

STIX ID: report--12874c0e-c769-5eff-bd96-cd50f3331bc4

Feed Name: Darknet

Threat Score
75/100

Date Published: 2025-06-06

Date Updated: 2026-05-11

...
...

DumpBrowserSecrets is a post-exploitation credential-harvesting tool that extracts saved credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from major Chromium-based browsers (Chrome, Edge, Brave, Opera, Opera GX, Vivaldi) and Firefox. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface to decrypt keys, supports DPAPI and NSS decryption models, includes multiple evasion measures (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser), and is intended for red-team assumed-breach testing while also demonstrating a high-risk credential attack surface for enterprises.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.