A PHP Script Encoder to 'Obfuscate/Encode' PHP Files
ID: 225cddda-a688-57e3-87ae-2b5e1eb118cb
STIX ID: report--225cddda-a688-57e3-87ae-2b5e1eb118cb
Feed Name: Darknet
DumpBrowserSecrets is a public post‑exploitation tool that harvests browser‑stored secrets (passwords, cookies, OAuth tokens, credit cards, autofill, history) from major Windows browsers. It bypasses Chrome's App‑Bound Encryption by injecting a DLL into a spawned headless Chromium process using Early Bird APC and the IElevator COM interface, retrieves DPAPI or NSS keys for other browsers, and writes structured JSON output; the tool includes multiple operational evasion features and is intended for red team/assumed‑breach testing but could be repurposed by threat actors.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
