NSA Large Scale TURBINE Malware Also Target Sysadmins

DumpBrowserSecrets is a publicly available post-exploitation tool that extracts saved credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from major Chromium-based and Firefox browsers on Windows. It uses DLL injection into a headless Chromium process and the IElevator COM interface to decrypt App-Bound Encryption keys (Chrome/Edge/Brave), retrieves DPAPI keys for Opera-family browsers, and handles Firefox via NSS decryption; the report also covers evasion features, operational usage, detection indicators, and mitigations.