UK Consumers Lose Faith in ‘Phished’ Brands

DumpBrowserSecrets is a precompiled Windows post-exploitation tool that harvests browser‑stored credentials (cookies, saved passwords, OAuth refresh tokens, credit cards, autofill, history) from Chromium- and Gecko-based browsers. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, handles DPAPI and NSS decryption for other browsers, includes operational evasion (string obfuscation, API hashing, PPID/argument spoofing, file handle duplication), and is presented as a red-team/assumed-breach testing utility but poses significant risk if misused for cloud account takeover or lateral movement.