Axiom – Pen-Testing Server For Collecting Bug Bounties

DumpBrowserSecrets is a publicly documented post‑exploitation tool that extracts browser‑stored credentials and session tokens from Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox by combining a compiled executable and a DLL that can bypass Chrome's App‑Bound Encryption (via IElevator COM when injected into a headless Chromium process). The report details its extraction capabilities (passwords, cookies, OAuth tokens, autofill, credit cards, history), operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection, handle duplication), recommended detections (monitor IElevator usage, anomalous headless browser processes, non‑browser reads of browser SQLite DBs), and mitigation advice (use of external credential managers and EDR rules).