US, UK & 3 Others Involved in Mock Cyberwar

DumpBrowserSecrets is a Windows post-exploitation tool that harvests browser-stored credentials (saved passwords, session cookies, OAuth refresh tokens, credit cards, autofill data, history, and bookmarks) from Chromium-based browsers and Firefox. It circumvents Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, handles DPAPI and NSS decryption for other browsers, and includes operational evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, file-handle duplication). The report outlines usage, an example attack scenario, detection opportunities (monitoring IElevator use, headless browser instantiation, reads of Login Data/Cookies/Web Data by non-browser processes), and mitigations such as using dedicated credential managers and EDR rules.