Caracal – Rust eBPF Rootkit for Stealthy Post-Exploitation

DumpBrowserSecrets is a precompiled Windows post-exploitation tool that extracts saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries and browsing history from Chromium-based browsers (Chrome, Edge, Brave, Opera variants, Vivaldi) and Firefox by bypassing App-Bound Encryption (using a headless Chromium process, Early Bird APC DLL injection and the IElevator COM interface) or by DPAPI/NSS decryption; the report documents its internals, operational evasion techniques, example attack scenarios, detection opportunities, and relevance to red teams and enterprise defenses.