New ‘Sryxen’ Stealer Bypasses Chrome Encryption via Headless Browser Technique
An information stealer named Sryxen has surfaced in the malware market, targeting Windows systems to extract browser credentials and sensitive data using advanced methods.
An information stealer named Sryxen has surfaced in the malware market, targeting Windows systems to extract browser credentials and sensitive data using advanced methods.
Sryxen is offered as Malware-as-a-Service and is developed using C++. It demonstrates the adaptation of modern stealers to circumvent browser security improvements, particularly Google Chrome's App-Bound Encryption.
This malware functions as a credential harvester, executing quickly without maintaining persistence on the infected systems.
Targeting Chrome version 127 and higher, Sryxen circumvents App-Bound Encryption, a security measure designed to protect cookies and browser data.
Instead of directly attacking this encryption, Sryxen employs an innovative approach by launching Chrome in headless mode and utilizing the DevTools Protocol to request decrypted cookie data, effectively bypassing the security measure.
Security researchers from DeceptIQ have identified that Sryxen uses multiple protection layers to avoid detection and analysis.
It demonstrates the adaptation of modern stealers to circumvent browser security improvements, particularly Google Chrome's App-Bound Encryption.
The malware employs Vectored Exception Handling-based code encryption, keeping the main payload encrypted at rest, decrypting it during execution through exception handling mechanisms. This makes static analysis difficult as the code appears as garbage data without execution.
Furthermore, it includes six anti-debug checks, such as NtGlobalFlag inspection and PEB analysis, terminating if debugging tools are present.
Sryxen's significant innovation lies in its method of extracting Chrome cookies protected by App-Bound Encryption.
Upon detecting Chrome version 127 or higher, the malware bypasses traditional database extraction methods. It terminates existing Chrome processes and relaunches the browser with specific command-line arguments, including --headless , --remote-debugging-port , and --user-data-dir .
These flags enable remote debugging without visible windows. Sryxen then connects to the debugging port via WebSocket and sends a DevTools Protocol command to retrieve all cookies through the Network.getAllCookies method.
Chrome processes this request, decrypting cookies using its App-Bound Encryption key and delivering the plaintext data to the stealer. The decrypted cookies do not touch the disk, rendering file-based monitoring ineffective.
After acquiring the data, Sryxen terminates Chrome and proceeds to collect other browser information, passwords, and cryptocurrency wallet data, compressing them into an archive for upload to a Telegram bot controlled by the attackers using curl commands executed through PowerShell.
Based on reporting by Cyber Security News.