The New Look Darknet & A New VPS
ID: ffb43741-fd9a-5d5b-8f6e-4f372998ace0
STIX ID: report--ffb43741-fd9a-5d5b-8f6e-4f372998ace0
Feed Name: Darknet
DumpBrowserSecrets is a post-exploitation credential-harvesting tool targeting major browsers (Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox). It bypasses Chrome's App-Bound Encryption by spawning a headless Chromium process and injecting a DLL via Early Bird APC to call the IElevator COM interface, extracts DPAPI or NSS-protected keys where relevant, and outputs structured JSON containing cookies, saved logins, OAuth refresh tokens, credit cards, autofill data, and history. The report covers technical implementation, operational evasion features, detection opportunities, and red-team applicability.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
