Domain Stealing or How to Hijack a Domain

DumpBrowserSecrets is a publicly available post‑exploitation credential‑harvesting tool that extracts saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from major Windows browsers (Chromium-based and Firefox). It achieves this by spawning a headless Chromium process and injecting a DLL to leverage the IElevator COM interface to decrypt app‑bound encryption keys (and uses DPAPI/NSS approaches where appropriate), includes operational evasion features to reduce detection, and is intended for red‑team assumed‑breach exercises but could be repurposed by malicious actors to enable cloud account takeover and lateral movement.