logo

Unix/Linux User Privilege Escalation Scanner

ID: f125eca3-eed1-5e51-94c7-785e85e433e8

STIX ID: report--f125eca3-eed1-5e51-94c7-785e85e433e8

Feed Name: Darknet

Threat Score
75/100

Date Published: 2015-06-22

Date Updated: 2026-05-08

...
...

DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool that extracts saved credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from Chromium‑based browsers (Chrome, Edge, Brave, Opera variants, Vivaldi) and Firefox. The report details the tool's architecture (an executable plus an injected DLL for App‑Bound Encryption bypass via the IElevator COM interface), evasion features (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection), typical attack scenarios and operational impact (fast credential collection enabling cloud account takeover and lateral movement), plus detection and mitigation guidance for defenders.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.