Hackers Target Home Users for Cash

DumpBrowserSecrets is a publicly available post‑exploitation tool that harvests browser-stored credentials and tokens from Windows hosts (Chrome/Edge/Brave via an App‑Bound Encryption bypass, Opera/Vivaldi via DPAPI, and Firefox via NSS). It uses headless Chromium + DLL injection (Early Bird APC) to decrypt app_bound_encrypted_key via the IElevator COM interface, extracts credentials from on-disk SQLite/JSON stores, includes multiple EDR-evasion features, and outputs structured JSON for red-team or malicious reuse — exposing a high-impact attack surface for cloud/SaaS account takeover and lateral movement.