Browzar is Bullshit

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool that targets major Windows browsers (Chrome, Edge, Brave, Opera family, Vivaldi, and Firefox) to extract saved passwords, session cookies, OAuth refresh tokens, credit card data and browsing history. The tool bypasses Chromium's App‑Bound Encryption (Chrome 127+) by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, retrieves DPAPI or NSS keys where applicable, parses browser SQLite/JSON stores, and outputs structured JSON; it includes multiple evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser). The report includes an attack scenario, red team relevance, and detection/mitigation guidance focused on monitoring IElevator calls, unexpected process injection, headless browser instantiation, and non‑browser reads of browser data stores.