Shadowserver Battles the Botnets

DumpBrowserSecrets is a publicly available Windows post‑exploitation tool that harvests browser‑stored credentials and session tokens from Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox by bypassing App‑Bound Encryption (via headless Chromium + injected DLL and IElevator COM), using DPAPI extraction, and NSS decryption for Firefox. The report details its operation, evasion techniques, supported browsers and data types, an example attack scenario, detection opportunities, and mitigation recommendations to evaluate enterprise exposure to browser-based credential theft.