Storm Worm Spreading Some Holiday Cheer

DumpBrowserSecrets is a publicly documented post‑exploitation tool that harvests browser-stored credentials and session tokens from major Chromium- and Firefox-based browsers. It implements an App‑Bound Encryption bypass for Chrome/Edge/Brave by injecting a DLL into a spawned headless Chromium process to use the IElevator COM interface, retrieves DPAPI keys for Opera-family browsers, and handles Firefox NSS decryption directly; output is structured JSON. The report covers supported browsers, extracted data types (passwords, cookies, OAuth tokens, credit cards, autofill, history), evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection), an attack scenario and detection/mitigation recommendations.