Password Hasher Firefox Extension
ID: 72e3b4db-0db7-5396-922a-2f9acbbebec9
STIX ID: report--72e3b4db-0db7-5396-922a-2f9acbbebec9
Feed Name: Darknet
DumpBrowserSecrets is a precompiled Windows post-exploitation tool that harvests browser-stored secrets (saved logins, session cookies, OAuth refresh tokens, credit cards, autofill data, history, and bookmarks) from major Chromium-based and Firefox browsers. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL that uses the IElevator COM interface to decrypt keys, handles DPAPI and NSS decryption for other browsers, employs multiple evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection, custom SQLite parser), and outputs structured JSON for red-team use — representing a high-risk capability for cloud account takeover and lateral movement if misused.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
