The case illustrates the power of structured host-based triage — beginning with logs and EDR, and moving through file inspection, RAM capture, and finally, network artifact confirmation.

This case study documents a stealthy credential-harvesting technique in which the attacker used a lightweight binary (browserdump.exe) to extract stored credentials from browser cache files—specifically Chrome and Edge—without elevating privileges or triggering persistence indicators.

ARP Spoofing is not an isolated event—it is the tactical execution of a mid-stage attacker who has already compromised a host and now seeks to manipulate local traffic routing for stealthy gain.