Rackspace Recovers From Major DNS DDoS
ID: b58bd117-57b8-5183-a490-b9d1467cd42f
STIX ID: report--b58bd117-57b8-5183-a490-b9d1467cd42f
Feed Name: Darknet
DumpBrowserSecrets is a post‑exploitation credential harvesting tool that targets Chromium‑based and Firefox browsers on Windows, including a bypass for Chrome’s App‑Bound Encryption by injecting a DLL into a headless Chromium process to call the IElevator COM interface. It extracts cookies, saved logins, OAuth refresh tokens, credit card data, autofill entries and history, includes evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), outputs structured JSON for red‑team use, and is relevant for testing detection and mitigation of browser-based credential theft.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
