logo

Identify CMS, Blogging Platform, Stats Packages

ID: 827d9f9e-5d0f-5eba-a8cd-8eca13d91001

STIX ID: report--827d9f9e-5d0f-5eba-a8cd-8eca13d91001

Feed Name: Darknet

Threat Score
75/100

Date Published: 2014-12-05

Date Updated: 2026-05-08

...
...

DumpBrowserSecrets is a publicly released post‑exploitation tool that harvests browser-stored secrets (cookies, saved credentials, OAuth refresh tokens, credit cards, autofill, history, bookmarks) from major Chromium-based and Firefox browsers. It bypasses Chrome's App‑Bound Encryption by injecting a DLL into a headless Chromium process to use the IElevator COM interface, handles DPAPI and NSS encryption models for other browsers, and includes evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, custom SQLite parser). The report explains usage, attacker scenarios (fast credential extraction enabling cloud account takeover and lateral movement), detection opportunities (injection, IElevator calls, unexpected SQLite reads, headless browser instantiation) and mitigation recommendations (use of external credential managers, EDR monitoring of IElevator and headless browsers).

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.