logo

Keep on Fuzzing! Advice

ID: b06a69b0-7e47-543d-82a3-fe47d2aaebab

STIX ID: report--b06a69b0-7e47-543d-82a3-fe47d2aaebab

Feed Name: Darknet

Threat Score
75/100

Date Published: 2008-04-13

Date Updated: 2026-05-08

...
...

DumpBrowserSecrets is a Windows post-exploitation tool that extracts saved credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries and history from major browsers (Chrome/Edge/Brave via App‑Bound Encryption bypass, Opera/Vivaldi via DPAPI, and Firefox via NSS). It uses a compiled executable plus a DLL injected into a headless Chromium process (Early Bird APC) to call the IElevator COM interface and decrypt app_bound_encrypted_key, includes operational evasion features to reduce EDR detection, outputs structured JSON, and is intended for red team / assumed-breach testing while demonstrating a realistic credential attack surface for cloud and SaaS account takeover.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.