Malware Pushers Abuse Firefox Warning Page

DumpBrowserSecrets is a publicly documented post‑exploitation tool that harvests browser‑stored secrets (saved logins, session cookies, OAuth refresh tokens, credit cards, autofill, history, bookmarks) from major Chromium‑based browsers and Firefox. It implements an App‑Bound Encryption bypass for Chrome/Brave/Edge by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface, uses DPAPI extraction for Opera/Vivaldi, and NSS decryption for Firefox, includes multiple operational evasion features (string obfuscation, API hashing, Early Bird APC injection, PPID/argument spoofing, custom SQLite parser), and writes structured JSON output to facilitate credential replay and lateral movement; the report also outlines detection and mitigation opportunities.