PRISM, Edward Snowden, Big Brother & More Stuff We Already Knew

DumpBrowserSecrets is a post-exploitation credential-harvesting tool that targets major Windows browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox) to extract saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, history, and bookmarks. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL via Early Bird APC to call the IElevator COM interface and decrypt the app_bound_encrypted_key, uses DPAPI or NSS decryption for other browsers, and includes operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, and a custom SQLite parser). The report highlights practical attack scenarios, detection opportunities (unexpected process injection, headless browser instantiation, reads of browser SQLite DBs, IElevator calls), and mitigation strategies such as using external credential managers and EDR rules that monitor for these specific behaviors.