Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

New VoidStealer Variant Bypasses Chrome ABE Without Injection or Privilege Escalation

A newly identified variant of the VoidStealer infostealer has emerged, capable of bypassing Google Chrome's Application-Bound Encryption (ABE) without the need for code injection or elevated system privileges. This development marks a significant change…

HBy Hazel CaldwellMar 21, 20261 min read

A newly identified variant of the VoidStealer infostealer has emerged, capable of bypassing Google Chrome's Application-Bound Encryption (ABE) without the need for code injection or elevated system privileges. This development marks a significant change in credential theft methodologies.

Technical Specifications of VoidStealer Version 2.0

Released on March 13, 2026, VoidStealer version 2.0 employs a debugger-based technique to extract encrypted browser credentials directly from memory. This approach circumvents the need for traditional methods involving code injection or high-level privileges.

Google implemented ABE in July 2024 with Chrome 127 to enhance the security of sensitive browser data. ABE's protection mechanism involves the v20_master_key , tied to a SYSTEM-level service known as the Google Chrome Elevation Service. Despite these measures, new bypass techniques have continued to evolve.

VoidStealer's Evolution and Detection Challenges

Initially appearing on dark web forums in December 2025, VoidStealer has rapidly advanced from version 1.0 to version 2.1. The latest version utilizes techniques from the open-source ElevationKatz project, allowing for a stealthier approach to bypassing ABE.

This development marks a significant change in credential theft methodologies.
Hazel Caldwell · Thehackingpost

The detection footprint of VoidStealer is notably low, as it leverages standard Windows debugging APIs rather than direct memory modifications. This makes it less detectable by existing security tools.

VoidStealer attaches itself to the Chrome or Edge browser as a debugger, setting hardware breakpoints at the precise moment when the v20_master_key appears in memory as plaintext. This is achieved through a sequence of operations involving CreateProcessW , DebugActiveProcess , and WaitForDebugEvent . The malware then extracts the key using ReadProcessMemory without altering the browser's memory.

Advertisement

Security measures should include monitoring processes that attach debuggers to browsers, flagging browsers launched with SW_HIDE or headless flags, and alerting on unexpected DebugActiveProcess calls targeting browsers. The known indicator of compromise for VoidStealer v2.0 is f783fde5cf7930e4b3054393efadd3675b505cbef8e9d7ae58aa35b435adeea4 .

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026