OS X Lion Brings Major Security Overhaul To Apple Users

DumpBrowserSecrets is a post-exploitation credential-harvesting tool (executable + DLL) that extracts saved passwords, cookies, OAuth refresh tokens, credit cards, autofill data and history from Chrome, Edge, Brave, Opera variants, Vivaldi and Firefox. For Chromium-based browsers it bypasses App-Bound Encryption by spawning a headless Chromium process and injecting a DLL that uses the IElevator COM interface to decrypt the app_bound_encrypted_key; for DPAPI-based browsers it retrieves DPAPI keys and for Firefox it uses NSS decryption. The tool outputs structured JSON, includes evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parsing), is distributed as a precompiled Windows executable (with source available), and the report includes usage examples, an attack scenario, and recommendations for detection and mitigation.