Loading story…
Researchers reported that the VoidStealer infostealer is using a new debugger-based technique to bypass Google Chrome’s Application-Bound Encryption (ABE) and steal the browser’s v20_master_key from memory. Gen Digital said the malware, offered as a Malware-as-a-Service operation and advertised on forums including HackForums, captures the key at the brief moment it appears in plaintext during browser startup, then uses it to decrypt protected browser data from Chrome and Microsoft Edge.
The method relies on standard Windows debugging APIs and hardware breakpoints rather than code injection, browser memory modification, or elevated privileges, making it quieter than earlier ABE bypasses. Researchers said this is the first publicly reported infostealer observed in the wild using this mechanism, likely adapted from the open-source ElevationKatz project in the ChromeKatz toolset. The finding raises concern that other stealers may adopt the same approach, and defenders were urged to watch for suspicious debugger attachment to browser processes, hidden or headless browser launches, and unexpected memory reads targeting browsers.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Gen Digital publicly reported that VoidStealer was the first infostealer observed in the wild using a debugger-based method with hardware breakpoints to steal Chrome's master key from memory and decrypt protected browser data. Researchers also assessed the technique was likely adapted from the open-source ElevationKatz/ChromeKatz tooling rather than developed independently.
On March 13, 2026, VoidStealer version 2.0 added a debugger-based technique that captures Chrome and Edge's decrypted v20_master_key from memory during browser startup using standard Windows debugging APIs. The method avoids code injection and elevated privileges, making it stealthier than earlier ABE bypass approaches.
Gen Digital said VoidStealer emerged on dark web forums such as HackForums in mid-December 2025 as a Malware-as-a-Service infostealer and then evolved rapidly through multiple versions.
Google rolled out Application-Bound Encryption (ABE) in Chrome 127 to better protect cookies and other browser secrets by keeping the master key encrypted on disk and validating decryption through the Chrome Elevation Service running as SYSTEM.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google introduced **Application-Bound Encryption** in Chrome 127 for Windows to reduce browser-cookie theft by malware running as the logged-in user. The protection routes decryption through a privileged service that validates Chrome’s application identity, replacing reliance on DPAPI alone and raising the bar for attackers to obtain SYSTEM privileges or inject code into Chrome. Google began the migration with cookies and plans to extend it to passwords, payment data, and other persistent authentication tokens. Infostealer families including **STEALC/VIDAR**, **MetaStealer**, **Phemedrone**, **XenoStealer**, and **Lumma** adapted by scraping plaintext cookies from Chrome process memory, abusing the Chrome elevation service through COM, injecting into browser processes, or enabling Chrome remote debugging to recover session tokens. Subsequent Hannibal Stealer research also examined the contest between browser protections and credential-stealing malware. Defenders can detect these bypasses through anomalous Chrome child-process activity, memory access, access to cookie files or elevation-service registry keys, localhost debugging traffic, and untrusted code placed in Chrome application directories.
Sep 9, 2026
A serious unpatched **Chromium** vulnerability was accidentally exposed after Google engineers marked the issue as fixed without shipping a patch, causing the bug report and proof-of-concept to become public. The flaw, originally reported in 2022, abuses the **Background Fetch API** to keep a Service Worker and malicious JavaScript running after the browser is closed and, in some cases, even after a device reboot. Affected products include **Chrome**, **Microsoft Edge**, **Brave**, **Opera**, **Vivaldi**, and **Arc**. The bug could let attackers abuse victims’ browsers for proxying traffic, launching DDoS activity, opening websites, and tracking user behavior; Google later re-hid the report and said it is working on a fix. Separately, researchers analyzing the **VoidStealer** infostealer found it can bypass Chrome’s **Application-Bound Encryption (ABE)** on Windows by attaching to the browser as a debugger, intercepting the moment Chrome decrypts protected data, and extracting the master key from memory. That technique enables theft of cookies, sessions, and other sensitive browser data, and the risk extends to other Chromium-based browsers using the same protection model. Together, the disclosures show that Chromium ecosystems face both browser-level persistence abuse and post-compromise data theft, with defenders urged to watch for unusual download-menu behavior, keep browsers updated as fixes arrive, and harden endpoints against infostealer activity.
Jun 29, 2026
A new information-stealing malware named **Arkanix** has emerged, targeting users for short-term financial gain. Arkanix is distributed primarily through Discord, masquerading as legitimate tools or being shared on online forums. The malware has evolved rapidly, with an initial Python-based version and a more advanced C++ implementation now available as a "Premium" option. The C++ version leverages process injection techniques to bypass Chrome's app-bound encryption, allowing it to extract sensitive data such as credentials, VPN accounts, Steam accounts, screenshots, and Wi-Fi credentials. The threat actors behind Arkanix also employ obfuscation tools like VMProtect to evade detection and offer a web-based control panel accessible via invite codes distributed on Discord. Security researchers have noted that Arkanix is likely designed for quick, short-term profit, with its operators focusing on rapid development and distribution rather than long-term campaigns. The malware's web panel provides various options for managing stolen data and customizing payloads, indicating a level of sophistication in its operation. The use of C++ process injection to defeat Chrome's encryption mechanisms marks a notable advancement in stealer malware capabilities, raising concerns about the effectiveness of current browser security measures against such threats.
Jun 29, 2026