May Commenter of the Month Competition Winner!

DumpBrowserSecrets is a publicly available post‑exploitation tool that harvests browser‑stored secrets (saved passwords, session cookies, OAuth refresh tokens, credit cards, autofill data, and history) from major Chromium‑based and Gecko‑based browsers. It implements a technical bypass of Chrome's App‑Bound Encryption by injecting a DLL into a spawned headless Chromium process and using the IElevator COM interface to decrypt encryption keys, supports DPAPI and NSS decryption for other browsers, and includes multiple evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, and a custom SQLite parser) to reduce detection; output is structured JSON for red‑team use but presents a high risk if used by malicious actors.