Massive Malware Outbreak Infects 30,000 Websites

DumpBrowserSecrets is a public post-exploitation tool that harvests browser-stored secrets (saved passwords, cookies, OAuth refresh tokens, credit cards, autofill data, history, bookmarks) from Chromium-based and Firefox browsers on Windows. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, supports DPAPI and NSS decryption for other browsers, includes multiple evasion features (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection, custom SQLite parser), outputs structured JSON, and is intended for red team/assumed-breach testing but represents a high-risk capability for credential and cloud account takeover if used maliciously.