logo

Password Hasher Firefox Extension

ID: 72e3b4db-0db7-5396-922a-2f9acbbebec9

STIX ID: report--72e3b4db-0db7-5396-922a-2f9acbbebec9

Feed Name: Darknet

Threat Score
75/100

Date Published: 2008-02-14

Date Updated: 2026-05-08

...
...

DumpBrowserSecrets is a precompiled Windows post-exploitation tool that harvests browser-stored secrets (saved logins, session cookies, OAuth refresh tokens, credit cards, autofill data, history, and bookmarks) from major Chromium-based and Firefox browsers. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL that uses the IElevator COM interface to decrypt keys, handles DPAPI and NSS decryption for other browsers, employs multiple evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection, custom SQLite parser), and outputs structured JSON for red-team use — representing a high-risk capability for cloud account takeover and lateral movement if misused.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.