zCodec Video Codec is a TROJAN
ID: 262bc8a4-74ce-58a8-9cdf-fa5368ad9ed0
STIX ID: report--262bc8a4-74ce-58a8-9cdf-fa5368ad9ed0
Feed Name: Darknet
DumpBrowserSecrets is a post-exploitation credential-extraction tool that targets major Windows browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox) to harvest saved logins, cookies, OAuth refresh tokens, credit cards, autofill data, history, and bookmarks. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, and uses other operational evasion techniques (Early Bird APC injection, PPID/argument spoofing, API hashing, custom SQLite parsing). The report details usage, extracted data formats (JSON output), red-team relevance, and detection/mitigation strategies such as monitoring IElevator calls, headless browser instantiation, and restricting browser-stored credentials in enterprise environments.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
