Photos as Visual Passwords Could Foil Hackers?
ID: 2e2de8ee-283b-5800-8b13-3eab8063c57d
STIX ID: report--2e2de8ee-283b-5800-8b13-3eab8063c57d
Feed Name: Darknet
DumpBrowserSecrets is a precompiled Windows post-exploitation tool that harvests browser-stored credentials and session tokens from major Chromium-based browsers and Firefox by combining a compiled executable and a DLL that is injected into a headless Chromium process to bypass App-Bound Encryption (via the IElevator COM interface) or by retrieving DPAPI/NSS keys for other browsers; it outputs structured JSON and includes evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection, handle duplication, and a custom SQLite parser) intended to survive EDR scrutiny and facilitate rapid lateral movement and cloud account takeover from a compromised host.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
