Memhunter – Automated Memory Resident Malware Detection

DumpBrowserSecrets is a post-exploitation browser credential-harvesting tool that targets Chromium-based and Gecko-based browsers to extract saved logins, session cookies, OAuth refresh tokens, credit card data, autofill entries, and history. It uses DLL injection into a headless Chromium process and the IElevator COM interface to bypass App‑Bound Encryption (Chrome 127+), handles DPAPI and NSS decryption for other browsers, and includes operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parsing). The report details usage, an operator attack scenario, detection opportunities (process injection, headless browser instantiation, IElevator calls, reads of Login Data/Cookies/Web Data by non-browser processes) and mitigations such as using dedicated password managers and EDR rules that monitor IElevator and headless browser behavior.