A Look Back At 2015 – Tools & News Highlights

DumpBrowserSecrets is a precompiled Windows post‑exploitation tool that harvests browser‑stored secrets across Chromium‑based and Firefox browsers by injecting a DLL into a headless Chromium process to decrypt App‑Bound Encryption keys via the IElevator COM interface, retrieving DPAPI keys for some Chromium forks, and using NSS decryption for Firefox; it outputs structured JSON and includes operational evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection, handle duplication, and a custom SQLite parser). The report documents supported browsers and data types, installation and usage, a realistic attack scenario demonstrating rapid token and credential theft enabling cloud account takeover, and detection/mitigation recommendations for EDRs and policy controls.