Proof of Concept for Internet Explorer Modal Dialog Exploit
ID: 76d2f7ec-ea77-567f-8e43-49f9ab779b09
STIX ID: report--76d2f7ec-ea77-567f-8e43-49f9ab779b09
Feed Name: Darknet
DumpBrowserSecrets is a post-exploitation credential-harvesting tool that extracts saved passwords, session cookies, OAuth refresh tokens, credit card numbers, autofill data, and browsing history from Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox. It implements an App-Bound Encryption bypass for Chromium-based browsers by spawning a headless Chromium process and injecting a DLL via Early Bird APC to use the IElevator COM interface, supports DPAPI and NSS decryption models, includes multiple evasion features, outputs structured JSON, and is positioned for red-team assumed-breach testing while also being usable by attackers to enable lateral movement and cloud account takeover.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
