logo

Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation

ID: ea8dd186-04c3-5292-be84-d928ea4c9c1f

STIX ID: report--ea8dd186-04c3-5292-be84-d928ea4c9c1f

Feed Name: Darknet

Threat Score
70/100

Date Published: 2025-05-09

Date Updated: 2026-05-11

...
...

DumpBrowserSecrets is a publicly available post‑exploitation tool that harvests browser‑stored secrets (saved logins, session cookies, OAuth refresh tokens, credit card numbers, autofill data, and history) from Chromium-based browsers and Firefox. It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, handles DPAPI and NSS decryption for other browsers, writes structured JSON output, and includes multiple operational evasion features intended for red-team or adversary use.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.