Hacking Tools, Hacker News & Cyber Security

DumpBrowserSecrets is a Windows post-exploitation tool that harvests browser-stored credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries, and history from Chromium-based and Firefox browsers. It bypasses Chrome's App‑Bound Encryption (Chrome 127+) by spawning a headless Chromium instance, injecting a DLL via Early Bird APC to leverage the IElevator COM interface and decrypt the app_bound_encrypted_key, and includes evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, and a custom SQLite parser). The tool outputs structured JSON suitable for red-team testing but could be misused by threat actors to enable lateral movement and cloud account takeover from a compromised Windows host.