New Sophisticated Botnets Discovered

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool (published on GitHub) that extracts saved passwords, session cookies, OAuth refresh tokens, credit card numbers, autofill data and browsing history from major browsers (Chrome, Edge, Brave, Opera family, Vivaldi, and Firefox). For Chromium-based browsers it bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process, injecting a DLL via Early Bird APC injection to call the IElevator COM interface and decrypt the app_bound_encrypted_key; for DPAPI‑based browsers it retrieves DPAPI keys and for Firefox it uses NSS decryption. The tool outputs structured JSON, includes multiple operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser), and the report describes attack scenarios, detection points (process injection, headless browser instantiation, IElevator calls, reads of Login Data/Cookies/Web Data), and mitigations such as using external password managers and EDR rules that monitor IElevator or headless browser behaviour.