Trojan Compromises 2,200 Oregon Tax Payers

DumpBrowserSecrets is a publicly distributed post‑exploitation tool that harvests browser-stored credentials and tokens from major Windows browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox). It implements an App‑Bound Encryption bypass for Chromium-based browsers by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface to decrypt encryption keys, and uses DPAPI/NSS handling for other browsers. The tool extracts cookies, saved logins, OAuth refresh tokens, credit cards, autofill data, and history, includes multiple evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), and outputs structured JSON for red-team or malicious use. The report covers usage examples, attack scenarios, detection opportunities, and mitigation recommendations such as using external credential managers and monitoring IElevator calls or unusual headless browser instantiations.