Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool that targets major browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox) to extract saved credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries, history, and bookmarks. It bypasses modern protections — notably Chrome's App‑Bound Encryption — by spawning a headless Chromium process and injecting a DLL via Early Bird APC to use the IElevator COM interface to decrypt keys; it also handles DPAPI and NSS models for other browsers. The report details architecture, usage examples, evasion techniques, an attack scenario demonstrating rapid credential extraction and session replay, and recommended detection and mitigation strategies for defenders.