VXers Group 29A Calls it Quits

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool (targeting Chrome/Edge/Brave via an App‑Bound Encryption bypass and Opera/Vivaldi via DPAPI, plus NSS decryption for Firefox) that extracts saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill and browsing history from local browser stores. The tool uses headless Chromium process spawning, Early Bird APC DLL injection to access the IElevator COM interface and decrypt app_bound_encrypted_key, plus evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parser). It is presented for red team use and includes detection and mitigation guidance focused on monitoring IElevator calls, unexpected headless browser instantiation, and unauthorized reads of browser SQLite files.