MySpace Hackers in Police Custody

DumpBrowserSecrets is a publicly available post-exploitation tool designed to harvest credentials and browser-stored secrets (passwords, session cookies, OAuth refresh tokens, credit cards, autofill data, history, bookmarks) from major browsers. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL using Early Bird APC injection to call the IElevator COM interface, handles DPAPI and NSS decryption for other browsers, includes operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), and outputs structured JSON for red-team use or assessment of credential blast radius; detection recommendations and mitigations are also provided.