Free Prep Material for LPI Linux Certification (LPI 201 and 202)
ID: ebb08b6b-d7cd-50eb-ad64-8bfc8e374b11
STIX ID: report--ebb08b6b-d7cd-50eb-ad64-8bfc8e374b11
Feed Name: Darknet
DumpBrowserSecrets is a precompiled Windows post‑exploitation tool that harvests saved passwords, session cookies, OAuth refresh tokens, credit card numbers, autofill data and browsing history from major Chromium-based browsers (Chrome, Edge, Brave, Opera variants, Vivaldi) and Firefox. It bypasses Chrome's App‑Bound Encryption by spawning a headless Chromium process and injecting a DLL to use the IElevator COM interface, handles DPAPI and NSS decryption as appropriate, includes evasion features (string obfuscation, API hashing, PPID/argument spoofing, handle duplication), and outputs structured JSON; the README also outlines attack scenarios, detection opportunities, and mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
