The Next Big Thing? Fortify Readiness Scorecard

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool that extracts saved credentials, session cookies, OAuth refresh tokens, credit cards, autofill data and history from major Chromium‑based and Firefox browsers on Windows. The tool bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL (using Early Bird APC) to call the IElevator COM interface, handles DPAPI for Opera/Vivaldi and NSS for Firefox, includes evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parsing), and is intended for red‑team testing but presents a realistic risk for lateral movement and cloud account takeover if misused.