Trojan Targets Google Text Based Adverts
ID: 5c916057-f6d0-5a1d-bd59-4a0da21d81b2
STIX ID: report--5c916057-f6d0-5a1d-bd59-4a0da21d81b2
Feed Name: Darknet
DumpBrowserSecrets is a post-exploitation credential-harvesting tool that extracts saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from major Chromium- and Gecko-based browsers. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, supports DPAPI and NSS decryption for other browsers, includes multiple evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), and is presented as a red-team tool with detection/mitigation guidance.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
