DPAPI
The Data Protection API is Windows' built-in way of encrypting secrets with keys tied to the user's logon or the machine.
DPAPI was introduced with Windows 2000 and protects saved passwords, certificates and other secrets. Applications call CryptProtectData and CryptUnprotectData, and Windows handles the key management. The application never sees the underlying key.
The trade-off is that anything running in the same user account can ask for the data to be decrypted. That is not a bug but a design choice that makes the API convenient, and it is why infostealers tend to go after exactly this source. Same user, same keys.