Open Source Blamed for Rootkits?

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool targeting Chromium- and Gecko-based browsers that bypasses Chrome's App‑Bound Encryption (via IElevator COM usage inside an injected DLL) and leverages DPAPI/NSS decryption to extract cookies, saved credentials, OAuth refresh tokens, credit card data, autofill entries, and browsing history into JSON. The report documents installation, usage examples, evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection), an attack scenario demonstrating rapid credential extraction and session replay, and detection/mitigation guidance for enterprise defenders.