Conficker Finally Awakes & Dumps Payload

DumpBrowserSecrets is a publicly available post-exploitation tool that harvests browser-stored secrets (saved logins, session cookies, OAuth refresh tokens, credit cards, autofill data, history, bookmarks) from Chromium-based (Chrome, Edge, Brave, Opera-family, Vivaldi) and Firefox browsers. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process, injecting a DLL via Early Bird APC to call the IElevator COM interface and retrieve decryption keys, and includes evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser). The report details usage, extracted output (JSON), operational scenarios, detection opportunities (unexpected process injection, headless browser instantiation, reads of browser SQLite DBs by non-browser processes, IElevator calls), and mitigations such as using dedicated credential managers and EDR rules targeting the described behaviors.