Web Technology Identifier (Identify CMS, JavaScript etc.)
ID: 3786bef9-fc01-556b-be03-02530d02ad49
STIX ID: report--3786bef9-fc01-556b-be03-02530d02ad49
Feed Name: Darknet
DumpBrowserSecrets is a publicly documented post‑exploitation tool that harvests browser-stored secrets (passwords, session cookies, OAuth refresh tokens, credit card data, autofill, history) from major Chromium-based browsers and Firefox. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium and injecting a DLL to call the IElevator COM interface, uses DPAPI or NSS as appropriate for other browsers, includes multiple evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, file-handle duplication), outputs structured JSON for red‑team use, and the report includes attack scenarios, detection cues, and mitigation recommendations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
