Malware

VoidStealer

VoidStealer is a Windows malware-as-a-service infostealer marketed since at least December 2025. Version 2.0, introduced in March 2026, bypasses Chromium Application-Bound Encryption to obtain the browser v20 master key without requiring elevated privileges or direct code injection. It launches a hidden browser process, attaches as a debugger, places hardware breakpoints on browser decryption code, and reads the plaintext key from browser memory when decryption occurs. The technique targets Google Chrome and Microsoft Edge and enables decryption of protected browser data, including saved credentials and session cookies. VoidStealer also implements a separate, noisier browser-injection method that invokes the browser elevation COM interface to decrypt protected data. Its debugger-based method has been assessed as adapted from the public ElevationKatz project. Theft of browser credentials and session cookies can enable account takeover and unauthorized access to authenticated services.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1204User ExecutionEvidence1

Не устанавливать программы, полученные из сомнительных источников... Изучить, как устроена атака ClickFix, — в последнее время стилеры часто распространяются именно с помощью этой вредоносной тактики.

T1559.001Component Object ModelEvidence1

The first is a well-documented approach that involves injecting into the browser process and invoking IElevator::DecryptData from the browser's context via the COM interface.

Persistence

1 technique

T1543Create or Modify System ProcessEvidence1

VoidStealer begins by spawning a browser process via CreateProcessW with the CREATE_SUSPENDED and SW_HIDE flags. It then resumes the main thread and immediately attaches a debugger to the newly spawned process via DebugActiveProcess.

Privilege Escalation

3 techniques

T1055Process InjectionEvidence6

Чтобы воспользоваться этим «окном возможностей», вредоносное ПО подключается к процессу Chrome как отладчик...

T1055.009Proc MemoryEvidence2

When the breakpoint triggers, the R15 register for Chrome or R14 register for Edge holds a direct pointer to the v20_master_key, which VoidStealer then extracts using just two ReadProcessMemory calls.

T1543Create or Modify System ProcessEvidence1

Stealth

4 techniques

T1055Process InjectionEvidence6

Чтобы воспользоваться этим «окном возможностей», вредоносное ПО подключается к процессу Chrome как отладчик...

T1055.009Proc MemoryEvidence2

T1564.003Hidden WindowEvidence2

VoidStealer begins by spawning a browser process using CreateProcessW with SW_HIDE and CREATE_SUSPENDED flags... Monitoring for browser memory reads from third-party processes, flagging browsers launched with SW_HIDE or headless flags...

T1622Debugger EvasionEvidence6

...вредоносное ПО подключается к процессу Chrome как отладчик — инструмент, позволяющий управлять выполнением программы, приостанавливать ее и просматривать содержимое памяти.

Credential Access

5 techniques

T1003OS Credential DumpingEvidence3

It targets the moment when Chrome needs to decrypts data and uses it to sign into a website or to access saved credentials, she noted. To do this, Chrome exposes the master key in plaintext in browser memory; VoidStealer authors figured out a way to take advantage of that brief window of opportunity.

T1539Steal Web Session CookieEvidence5

Особенную ценность для злоумышленников представляют собой так называемые сессионные файлы cookie... кража таких файлов позволяет злоумышленнику использовать уже подтвержденную сессию без ввода логина и пароля от лица жертвы.

T1555Credentials from Password StoresEvidence1

The variant, introduced in VoidStealer version 2.0 on March 13, 2026, uses a debugger-based technique to silently extract encrypted browser credentials directly from memory... VoidStealer currently targets both Google Chrome and Microsoft Edge.

T1555.003Credentials from Web BrowsersEvidence4

“The core stealer exfiltrates browser passwords and cookies” and “launches the browser in a debugger and reads the decryption key from memory” to obtain Chrome credentials protected by App-Bound Encryption.

T1649Steal or Forge Authentication CertificatesEvidence1

The core of VoidStealer’s novel bypass involves attaching itself to the Chrome or Edge browser as a debugger and setting hardware breakpoints at the exact moment when the v20_master_key is briefly present in memory as plaintext.

Discovery

3 techniques

T1057Process DiscoveryEvidence2

It then listens for debug events through WaitForDebugEvent, monitoring each DLL as it loads into the browser’s memory space. Once chrome.dll or msedge.dll loads, VoidStealer uses ReadProcessMemory to scan the DLL’s .rdata section...

T1518Software DiscoveryEvidence1

Зловред заранее находит участок кода, где происходит расшифровка данных.

T1622Debugger EvasionEvidence6

Collection

1 technique

T1005Data from Local SystemEvidence2

Именно таким образом вредоносное ПО ловит момент, когда мастер-ключ уже находится в оперативной памяти в виде открытого текста, и считывает его оттуда напрямую.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 months ago

ACTIVITY FEED

Recent activity

12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

12 SOURCESView more in app

ctrlaltintel blogNews

Sep 12, 2026

Behind the CAPTCHA: ClickFix, WallStealer and a Hidden Miner - Ctrl-Alt-Intel

Mentioned as contextual comparison for its similar resolver mechanism; it was not identified in the analyzed collection.

the hacker newsNews

Sep 6, 2026

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Infostealer mentioned only as another malware observed using the Chrome App-Bound Encryption key-extraction technique.

gendigitalNews

Jun 18, 2026

Gen Blogs | Inside Vidar’s ABE Bypass: From Memory Scanning to APC Injections

VoidStealer is referenced as another infostealer previously discussed in relation to ABE inner workings.

ontinue blogNews

Jun 1, 2026

Ontinue breaks down a fake claude code installer

Referenced only as a comparison family that did not technically match the observed sample.

+8 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

VoidStealer