Mozilla Hires Ex-Microsoft Security Strategist Window Snyder

DumpBrowserSecrets is a post-exploitation credential-harvesting tool that extracts browser-stored secrets (saved logins, session cookies, OAuth tokens, credit cards, autofill data, history, bookmarks) from Chromium-based browsers and Firefox. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to call the IElevator COM interface to decrypt the app_bound_encrypted_key, supports DPAPI and NSS decryption for other browsers, includes operational evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), outputs structured JSON, and is positioned for red-team assumed-breach testing but materially enables account takeover and lateral movement if abused.