Loading malware…
VoidStealer is an information-stealing malware family offered under a malware-as-a-service model and publicly reported as active from at least December 2025, with reporting stating it surfaced in March 2026. It targets Google Chrome on Windows and also affects Chromium-based browsers that use Application-Bound Encryption (ABE), including Microsoft Edge, Brave, Opera, and Vivaldi. Its core objective is theft of browser secrets, including saved passwords, session cookies, payment data, and other sensitive browser-stored information, enabling account hijacking, financial theft, and identity fraud.
High-confidence reporting describes VoidStealer as the first infostealer observed in the wild using a debugger-based ABE bypass that does not require privilege escalation or direct code injection into the browser. In version 2.0, introduced on 2026-03-13, it spawns a hidden suspended browser process, resumes it, attaches as a debugger with DebugActiveProcess, monitors DLL load events, scans chrome.dll or msedge.dll for the string "OSCrypt.AppBoundProvider.Decrypt.ResultCode," locates the corresponding LEA instruction in the code section, and sets hardware breakpoints across browser threads via debug registers. When the breakpoint triggers during browser startup and protected data is being decrypted, VoidStealer reads the plaintext v20_master_key from browser memory using ReadProcessMemory; reporting states the pointer is held in R15 for Chrome and R14 for Edge. This technique was assessed by Gen Digital as adapted from the public ElevationKatz project.
Additional reporting states VoidStealer also implements an earlier injection/COM-based ABE bypass method that injects into the browser process and invokes IElevator::DecryptData through the browser elevation COM interface. Reporting consistently states that VoidStealer bypasses Chrome’s ABE by capturing the master key from memory during legitimate decryption operations rather than breaking the encryption itself.
Known indicators directly mentioned in the content include SHA-256 f783fde5cf7930e4b3054393efadd3675b505cbef8e9d7ae58aa35b435adeea4 for VoidStealer v2.0. Detection opportunities mentioned in the reporting include autonomous debugger attachment to browser processes, unexpected DebugActiveProcess calls targeting browsers, hidden or headless browser launches, third-party ReadProcessMemory activity against browser processes, and hardware breakpoint usage across browser threads.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Чтобы воспользоваться этим «окном возможностей», вредоносное ПО подключается к процессу Chrome как отладчик...
Чтобы воспользоваться этим «окном возможностей», вредоносное ПО подключается к процессу Chrome как отладчик...
When the breakpoint triggers, the R15 register for Chrome or R14 register for Edge holds a direct pointer to the v20_master_key, which VoidStealer then extracts using just two ReadProcessMemory calls.
It targets the moment when Chrome needs to decrypts data and uses it to sign into a website or to access saved credentials, she noted. To do this, Chrome exposes the master key in plaintext in browser memory; VoidStealer authors figured out a way to take advantage of that brief window of opportunity.
Особенную ценность для злоумышленников представляют собой так называемые сессионные файлы cookie... кража таких файлов позволяет злоумышленнику использовать уже подтвержденную сессию без ввода логина и пароля от лица жертвы.
The variant, introduced in VoidStealer version 2.0 on March 13, 2026, uses a debugger-based technique to silently extract encrypted browser credentials directly from memory... VoidStealer currently targets both Google Chrome and Microsoft Edge.
It then listens for debug events through WaitForDebugEvent, monitoring each DLL as it loads into the browser’s memory space. Once chrome.dll or msedge.dll loads, VoidStealer uses ReadProcessMemory to scan the DLL’s .rdata section...
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
VoidStealer is referenced as another infostealer previously discussed in relation to ABE inner workings.
Referenced only as a comparison family that did not technically match the observed sample.
An infostealer targeting Chrome and other Chromium-based browsers on Windows. It bypasses Chrome’s App-Bound Encryption by attaching to the browser as a debugger, setting a breakpoint where Chrome decrypts data, and reading the master key from memory to steal saved passwords, session cookies, and other sensitive browser data.
An infostealer that steals data stored by Chrome for Windows by bypassing Chrome’s App-Bound Encryption. It attaches to the Chrome process as a debugger, sets breakpoints at decryption code, and reads the browser master key from memory when it appears in plaintext. The operators run it under a malware-as-a-service model.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.