the Art of Virology 01h

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool (published by Maldev Academy) that extracts saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from major Windows browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox). It implements an App‑Bound Encryption bypass for Chromium-based browsers by spawning a headless Chromium process and injecting a DLL (via Early Bird APC) to use the IElevator COM interface to decrypt keys, and uses DPAPI/NSS handling for other browsers; the tool includes multiple evasion techniques and outputs structured JSON for red‑team use, with guidance on detection and mitigation.