logo

zCodec Video Codec is a TROJAN

ID: 262bc8a4-74ce-58a8-9cdf-fa5368ad9ed0

STIX ID: report--262bc8a4-74ce-58a8-9cdf-fa5368ad9ed0

Feed Name: Darknet

Threat Score
75/100

Date Published: 2006-10-15

Date Updated: 2026-05-08

...
...

DumpBrowserSecrets is a post-exploitation credential-extraction tool that targets major Windows browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox) to harvest saved logins, cookies, OAuth refresh tokens, credit cards, autofill data, history, and bookmarks. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, and uses other operational evasion techniques (Early Bird APC injection, PPID/argument spoofing, API hashing, custom SQLite parsing). The report details usage, extracted data formats (JSON output), red-team relevance, and detection/mitigation strategies such as monitoring IElevator calls, headless browser instantiation, and restricting browser-stored credentials in enterprise environments.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.