Unix/Linux User Privilege Escalation Scanner
ID: f125eca3-eed1-5e51-94c7-785e85e433e8
STIX ID: report--f125eca3-eed1-5e51-94c7-785e85e433e8
Feed Name: Darknet
DumpBrowserSecrets is a post‑exploitation credential‑harvesting tool that extracts saved credentials, session cookies, OAuth refresh tokens, credit card data, autofill entries, and browsing history from Chromium‑based browsers (Chrome, Edge, Brave, Opera variants, Vivaldi) and Firefox. The report details the tool's architecture (an executable plus an injected DLL for App‑Bound Encryption bypass via the IElevator COM interface), evasion features (string obfuscation, API hashing, PPID/argument spoofing, Early Bird APC injection), typical attack scenarios and operational impact (fast credential collection enabling cloud account takeover and lateral movement), plus detection and mitigation guidance for defenders.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
