Massive Data Theft Operation Uncovered

DumpBrowserSecrets is a publicly documented post-exploitation tool that extracts browser-stored secrets (saved credentials, session cookies, OAuth tokens, credit cards, autofill data, history, and bookmarks) from Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox. It implements an App‑Bound Encryption bypass for Chromium-based browsers by spawning a headless Chromium process and injecting a DLL via Early Bird APC to call the IElevator COM interface, retrieves DPAPI or NSS-protected keys where applicable, and includes multiple evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parsing) to reduce detection; the report covers usage, detection signals, and mitigation recommendations for enterprise environments.