France Complaining of China Hacks Too

DumpBrowserSecrets is a publicly available post‑exploitation tool that harvests browser‑stored credentials (cookies, saved logins, OAuth refresh tokens, credit cards, autofill, history, bookmarks) from major Chromium‑based and Firefox browsers. It implements an App‑Bound Encryption bypass for Chrome/Edge/Brave by spawning a headless Chromium process and injecting a DLL via Early Bird APC to use the IElevator COM interface to decrypt keys, handles DPAPI and NSS models for other browsers, and includes multiple evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication). The report highlights operational use, rapid extraction (<30s), detection opportunities, and recommends mitigations such as moving secrets out of browsers or monitoring IElevator and unexpected headless browser activity.