Microsoft Shelves Support for RSA SecurID in Vista
ID: 2dde8967-18a0-5572-ba69-2cd50064d6b9
STIX ID: report--2dde8967-18a0-5572-ba69-2cd50064d6b9
Feed Name: Darknet
DumpBrowserSecrets is a Windows post-exploitation tool that harvests browser-stored credentials and session tokens from Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox. It implements an App-Bound Encryption bypass for Chromium-based browsers by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface to decrypt the app_bound_encrypted_key, handles DPAPI and NSS decryption where applicable, and includes operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser). The tool outputs structured JSON and is presented as a red-team utility for assessing credential exposure and EDR effectiveness.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
