logo

Who is Haydies? Me my self and quite possibly some one else.

ID: 9cd5afe7-26c9-52c9-a0dd-06e2dc350329

STIX ID: report--9cd5afe7-26c9-52c9-a0dd-06e2dc350329

Feed Name: Darknet

Threat Score
75/100

Date Published: 2006-03-15

Date Updated: 2026-05-12

...
...

DumpBrowserSecrets is a post-exploitation credential-harvesting tool for Windows that extracts saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from major browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox). It implements an App‑Bound Encryption bypass for Chromium-based browsers by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, supports DPAPI and NSS decryption for other browsers, includes several evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser), and is distributed as a precompiled executable intended for red team use but readily usable by attackers to achieve rapid cloud account takeover and lateral movement.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.