BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy

DumpBrowserSecrets is a publicly available Windows post-exploitation tool that harvests browser-stored credentials and session tokens from Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, retrieves DPAPI or NSS-protected secrets as appropriate, and includes evasion techniques (string obfuscation, API hashing, PPID/argument spoofing, handle duplication, custom SQLite parsing). The tool outputs structured JSON of extracted data and is positioned for red-team/assumed-breach use, with recommended detections and mitigations focused on monitoring unexpected headless browser instantiation, IElevator COM calls, and non-browser reads of browser SQLite files.