the Art of Virology 03h

DumpBrowserSecrets is a Windows post‑exploitation tool that harvests browser‑stored secrets (cookies, saved credentials, OAuth refresh tokens, credit cards, autofill data, history, bookmarks) across Chromium‑based browsers and Firefox. It implements an App‑Bound Encryption bypass for Chrome/Edge/Brave by spawning a headless Chromium process and injecting a DLL via Early Bird APC to call the IElevator COM interface and decrypt the app_bound_encrypted_key, uses DPAPI extraction for Opera/Vivaldi, and NSS decryption for Firefox; the tool outputs structured JSON, includes multiple evasion features, and is positioned for red‑team testing but is usable by adversaries against compromised developer workstations.