Keep on Fuzzing! Advice
ID: b06a69b0-7e47-543d-82a3-fe47d2aaebab
STIX ID: report--b06a69b0-7e47-543d-82a3-fe47d2aaebab
Feed Name: Darknet
DumpBrowserSecrets is a Windows post-exploitation tool that extracts saved credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries and history from major browsers (Chrome/Edge/Brave via App‑Bound Encryption bypass, Opera/Vivaldi via DPAPI, and Firefox via NSS). It uses a compiled executable plus a DLL injected into a headless Chromium process (Early Bird APC) to call the IElevator COM interface and decrypt app_bound_encrypted_key, includes operational evasion features to reduce EDR detection, outputs structured JSON, and is intended for red team / assumed-breach testing while demonstrating a realistic credential attack surface for cloud and SaaS account takeover.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
