Expose Online Devices (Wind Turbines, Power Plants & More!)
ID: 8fc890f3-d07e-5344-99cc-994c3a26b4e7
STIX ID: report--8fc890f3-d07e-5344-99cc-994c3a26b4e7
Feed Name: Darknet
DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool that extracts browser‑stored secrets (saved logins, session cookies, OAuth refresh tokens, credit cards, autofill, history and bookmarks) from Chrome, Edge, Brave, Opera family, Vivaldi and Firefox. The tool implements an App‑Bound Encryption bypass for Chromium browsers by spawning a headless Chromium process and injecting a DLL via Early Bird APC to use the IElevator COM interface, includes multiple evasion features (string obfuscation, API hashing, PPID/argument spoofing, file-handle duplication), outputs structured JSON, and is intended for red team/assumed‑breach testing while also representing a high-risk capability if abused; the report covers functionality, usage, attack scenarios, detection points, and mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
