Falco – Real-Time Threat Detection for Linux and Containers

DumpBrowserSecrets is a publicly available post-exploitation tool (from Maldev Academy) that harvests credentials and session material from major Chromium- and Gecko-based browsers. It implements an App-Bound Encryption bypass for Chrome/Edge/Brave by injecting a DLL into a headless Chromium process using Early Bird APC injection and the IElevator COM interface, extracts DPAPI and NSS-protected data for other browsers, and outputs structured JSON. The report documents extracted data types, evasion features (string obfuscation, API hashing, PPID/argument spoofing, file-handle duplication), usage scenarios for red-team or malicious operators, and detection/mitigation guidance.