Loading story…
Google introduced Application-Bound Encryption in Chrome 127 for Windows to reduce browser-cookie theft by malware running as the logged-in user. The protection routes decryption through a privileged service that validates Chrome’s application identity, replacing reliance on DPAPI alone and raising the bar for attackers to obtain SYSTEM privileges or inject code into Chrome. Google began the migration with cookies and plans to extend it to passwords, payment data, and other persistent authentication tokens.
Infostealer families including STEALC/VIDAR, MetaStealer, Phemedrone, XenoStealer, and Lumma adapted by scraping plaintext cookies from Chrome process memory, abusing the Chrome elevation service through COM, injecting into browser processes, or enabling Chrome remote debugging to recover session tokens. Subsequent Hannibal Stealer research also examined the contest between browser protections and credential-stealing malware. Defenders can detect these bypasses through anomalous Chrome child-process activity, memory access, access to cookie files or elevation-service registry keys, localhost debugging traffic, and untrusted code placed in Chrome application directories.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
LUMMA implemented a bypass for Chrome cookie protections and recovered cookies from Chrome 130.0.6723.70 in Elastic's analysis. It reads Chrome memory, pattern-scans chrome.dll for CookieMonster, and extracts plaintext cookies.
METASTEALER announced an updated Chrome-cookie theft capability, claiming support for Chrome 129 and later. Its method obtains the application-bound key and abuses the GoogleChromeElevationService COM interface after impersonating SYSTEM.
XENOSTEALER's Chrome bypass feature was committed. It obtains the application-bound key from Chrome profile data, injects code into Chrome, and invokes the elevation service's DecryptData method from the Chrome process.
STEALC and VIDAR introduced a shared bypass implementation that extracts plaintext Chrome cookies from Chrome process memory. The technique locates Chrome's network service and reads CookieMonster data structures using process-memory access.
A PHEMEDRONE 2.3.2 sample submitted in late September added cookie theft for Chrome 127 and later. It launches Chrome with remote debugging enabled and retrieves plaintext cookies through the DevTools WebSocket interface.
The open-source XENOSTEALER infostealer first appeared, later adding functionality intended to bypass Chrome's Application-Bound Encryption.
Google introduced Application-Bound Encryption for Chrome 127 on Windows, beginning with cookies. The protection uses a SYSTEM-level service to bind decryption to Chrome's application identity rather than relying only on DPAPI.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
netlas.io
Open sourcenetlas.io
Open sourceelastic.co
Open sourcesecurity.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the `VoidStealer` infostealer is using a new debugger-based technique to bypass Google Chrome’s Application-Bound Encryption (ABE) and steal the browser’s `v20_master_key` from memory. Gen Digital said the malware, offered as a Malware-as-a-Service operation and advertised on forums including HackForums, captures the key at the brief moment it appears in plaintext during browser startup, then uses it to decrypt protected browser data from Chrome and Microsoft Edge. The method relies on standard Windows debugging APIs and hardware breakpoints rather than code injection, browser memory modification, or elevated privileges, making it quieter than earlier ABE bypasses. Researchers said this is the first publicly reported infostealer observed in the wild using this mechanism, likely adapted from the open-source `ElevationKatz` project in the `ChromeKatz` toolset. The finding raises concern that other stealers may adopt the same approach, and defenders were urged to watch for suspicious debugger attachment to browser processes, hidden or headless browser launches, and unexpected memory reads targeting browsers.
Jun 29, 2026
**Storm** is a newly advertised infostealer sold as a subscription-based cybercrime service that steals browser credentials, cookies, refresh tokens, cryptocurrency wallet data, documents, messaging app session data, screenshots, and system information. Reporting indicates it targets **Chromium** and **Gecko**-based browsers, including Chrome, Edge, Firefox, and Waterfox, while also going after services and apps such as **Telegram**, **Discord**, **Binance**, and **Coinbase**. Investigators observed victim logs spanning multiple countries, including India, Brazil, the United States, and the United Kingdom, and a criminal panel showing more than 1,700 log entries. The malware’s distinguishing feature is **server-side decryption**, which allows stolen browser data to be exfiltrated in encrypted form and decrypted on attacker-controlled infrastructure rather than on the victim device. That design reduces endpoint telemetry, helps evade antivirus detection, and reportedly undermines Chrome’s **App-Bound Encryption** protections. Storm also includes automated cookie restoration and the use of geographically matched **SOCKS5** proxies to re-establish authenticated sessions, enabling attackers to bypass password-based defenses and, in some cases, render **MFA** ineffective while accessing SaaS accounts, Microsoft 365, internal tools, and cloud environments.
Jun 29, 2026
Threat researchers reported continued growth in the **infostealer** ecosystem, with new families emphasizing theft of browser credentials, session cookies, and cryptocurrency wallet data. Zscaler ThreatLabz detailed **Marco Stealer**, first observed in June 2025, which profiles infected hosts (e.g., OS version, hardware ID, IP/geolocation) and targets browser data plus cryptocurrency wallet information from browser extensions; it also searches for sensitive files in local and **cloud-synced** locations, including folders associated with *Dropbox* and *Google Drive*, and uses anti-analysis measures such as runtime string decryption. Separately, Cyfirma described **LTX Stealer**, a Windows-focused infostealer built around a bundled **Node.js runtime** and delivered via an Inno Setup installer (`Negro.exe`) that drops an unusually large (~271 MB) payload—reportedly to evade scanning heuristics. LTX Stealer targets Chromium-based browsers by extracting keys from `Local State` to decrypt saved passwords and cookies, collects screenshots, and stages data for exfiltration while using services such as *Supabase* (authentication) and *Cloudflare* (infrastructure masking). Flare’s research contextualized these developments as part of an “infostealer arms race,” observing multiple variants being marketed/updated across dark web forums and highlighting the downstream impact: analysis of **18.7M** infostealer logs (2025) found enterprise SSO/IdP credentials in more than 10% of infections, and Verizon DBIR data cited by Flare linked infostealer credential exposure to a significant share of ransomware victimization; Flare also noted stealer developers rapidly adapting to Chrome’s evolving credential protections (e.g., post-`v127` application-bound encryption and newer Chrome releases).
Jun 29, 2026