Fitbit Vulnerability Means Your Tracker Could Spread Malware

DumpBrowserSecrets is a publicly documented post‑exploitation tool that harvests credentials and session tokens from major Windows browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox). It implements an App‑Bound Encryption bypass for Chromium‑based browsers by injecting a DLL into a headless Chromium process and using the IElevator COM interface to decrypt keys, and uses DPAPI/NSS handling where applicable; the tool outputs structured JSON and includes operational evasion techniques to reduce EDR detection, making it relevant for red teams and potentially malicious actors seeking account takeover and lateral movement.