VoidStealer malware steals Chrome master key via debugger trick
Recorded: March 22, 2026, 3 p.m.
| Original | Summarized |
VoidStealer malware steals Chrome master key via debugger trick News Featured Trivy vulnerability scanner breach pushed infostealer via GitHub Actions Microsoft Azure Monitor alerts abused for callback phishing attacks Musician admits to $10M streaming royalty fraud using AI bots FBI links Signal phishing attacks to Russian intelligence services Varonis Atlas: Securing AI and the Data That Powers It Microsoft Exchange Online service change causes email access issues Block ads and trackers on 9 devices for only $16 in this deal FBI warns of Handala hackers using Telegram in malware attacks Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityVoidStealer malware steals Chrome master key via debugger trick VoidStealer malware steals Chrome master key via debugger trick By Bill Toulas March 22, 2026 An information stealer called VoidStealer uses a new approach to bypass Chrome’s Application-Bound Encryption (ABE) and extract the master key for decrypting sensitive data stored in the browser. Overview of how ABE blocks out malwareSource: Gen Digital Cybercriminals advertising ABE bypass in VoidStealer version 2.0Source: Gen Digital VoidStealer's target stringSource: Gen Digital Red Report 2026: Why Ransomware Encryption Dropped 38% Related Articles: Encryption Keys Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Microsoft: March Windows updates break Teams, OneDrive sign-ins CISA orders feds to patch max-severity Cisco flaw by Sunday Microsoft Azure Monitor alerts abused for callback phishing attacks Sponsor Posts Secure your AI agents without sacrificing speed. Overdue a password health-check? Audit your Active Directory for free Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast. Are refund fraud methods targeting your brand? You can monitor the underground for these threats. AI is a data-breach time bomb: Read the new report Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
VoidStealer malware employs a sophisticated technique to exfiltrate Chrome’s master key, bypassing Google’s Application-Bound Encryption (ABE) mechanism. This novel approach, detailed by Vojtěch Krejsa at Gen Digital, utilizes hardware breakpoints to directly extract the v20_master_key from the browser’s memory—a feat achieved without requiring privilege escalation or code injection. This represents the first instance of an infostealer observed in the wild successfully utilizing this method. The discovery highlights a vulnerability in Chrome's security architecture, particularly concerning the reliance on the Google Chrome Elevation Service, which operates with SYSTEM-level privileges to validate decryption requests. The core of the VoidStealer’s strategy revolves around capitalizing on a brief window of opportunity during Chrome’s decryption processes. Specifically, the malware initiates a suspended, hidden browser process, attaches it as a debugger, and patiently waits for the target Chrome instance to load. Once the browser DLL (chrome.dll or msedge.dll) is loaded, it scans for specific strings and a designated LEA instruction linked to that string, using the corresponding address as the breakpoint target. Subsequently, it establishes hardware breakpoints across active browser threads, observing the triggering during startup when the browser is decrypting ABE-protected cookies, thereby forcing the extraction of the master key. The technique’s origins can be traced back to the open-source project ‘ElevationKatz’, a component within the ChromeKatz cookie-dumping toolset, which had been available for over a year. While VoidStealer incorporates modifications, its underlying implementation fundamentally relies on ElevationKatz’s approach. The malware identifies the key’s plaintext state in memory during decryption operations—a process facilitated by the ‘ReadProcessMemory’ function—targeting the pointer to the master key. This method was advertised on dark web forums since mid-December 2025 and is offered as a “Malware as a Service” (MaaS) platform. This breach further underscores the ongoing challenge of securing Chrome’s ABE implementation. Despite Google’s subsequent fixes and improvements intended to mitigate bypass attempts, the vulnerability persisted, highlighting the need for continuous vigilance and rapid response within the cybersecurity landscape. The successful deployment of VoidStealer demonstrates the continued ingenuity of cybercriminals in exploiting security weaknesses and the potential consequences of relying on open-source tools that may contain inherent vulnerabilities. The findings reinforce the critical importance of maintaining awareness regarding emerging threats and proactively addressing potential security gaps within widely used software applications, with Google being a key component in this matter. |