SANS Gateway Asia 2006

DumpBrowserSecrets is a Windows post-exploitation credential-harvesting tool that extracts saved passwords, session cookies, OAuth refresh tokens, credit card numbers, autofill data and browsing history from Chromium-based (Chrome, Edge, Brave, Opera, Vivaldi) and Firefox browsers. The tool bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL via Early Bird APC to call the IElevator COM interface, supports DPAPI and NSS decryption for other browsers, includes operational evasion techniques, and outputs structured JSON—making it a high-risk infostealer capability for compromised developer or enterprise workstations.