w3bfukk0r 0.2 Forced Browsing Tool Released
ID: e7bc5ab5-6cd1-5a88-b905-6ccac981321d
STIX ID: report--e7bc5ab5-6cd1-5a88-b905-6ccac981321d
Feed Name: Darknet
DumpBrowserSecrets is a post-exploitation credential-extraction tool that targets major browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox) to recover saved passwords, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history. It implements an App-Bound Encryption bypass for Chromium-based browsers by spawning a headless Chromium process and injecting a DLL via Early Bird APC to use the IElevator COM interface to decrypt encryption keys, and includes DPAPI and NSS handling for other browsers; the tool is built with operational evasion features and outputs structured JSON for red-team use but could be abused by attackers for cloud account takeover and lateral movement.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
