Microsoft Says You SHOULD Re-use Passwords Across Sites

DumpBrowserSecrets is a publicly released post‑exploitation tool that harvests browser‑stored credentials and session material (passwords, cookies, OAuth refresh tokens, credit cards, autofill and history) from major Chromium‑based browsers and Firefox; it implements an App‑Bound Encryption bypass for Chrome/Edge/Brave by injecting a DLL into a headless Chromium process to use the IElevator COM interface, includes DPAPI/NSS handling for other browsers, and contains operational evasion features aimed at reducing EDR detection—useful for red teams but also increasing abuse risk if adopted by adversaries.