TDL AKA Alureon Rootkit Now Infecting 64-Bit Windows 7 Platform

DumpBrowserSecrets is a publicly available post-exploitation tool that harvests browser-stored credentials and session tokens from major Windows browsers (Chrome/Edge/Brave via App-Bound Encryption bypass, Opera/Vivaldi via DPAPI, and Firefox via NSS). It uses headless Chromium + Early Bird APC DLL injection to decrypt app_bound_encrypted_key through the IElevator COM interface, includes evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), outputs structured JSON for red-team use, and can enable rapid lateral movement or cloud account takeover by exposing OAuth refresh tokens and active session cookies.