VoidStealer Steals Chrome Secrets Without Injection or Privilege Escalation
A new variant of the MaaS infostealer, VoidStealer, has been identified as the first malware to exploit a debugger-based bypass for Google Chrome's Application-Bound Encryption (ABE). This technique utilizes hardware breakpoints to access Chrome's…
A new variant of the MaaS infostealer, VoidStealer, has been identified as the first malware to exploit a debugger-based bypass for Google Chrome's Application-Bound Encryption (ABE). This technique utilizes hardware breakpoints to access Chrome's v20_master_key directly from the browser memory.
This bypass method contrasts previous techniques by eliminating the need for SYSTEM-level privilege escalation or code injection into the browser process. It offers attackers full access to ABE-protected cookies and credentials with a significantly reduced detection footprint.
ABE secures sensitive information like cookies and, in some configurations, passwords using a per-application AES-GCM key, known as the v20_master_key. This key is protected using CryptProtectData under NT AUTHORITY\SYSTEM and decrypted when Chrome calls IElevator::Decrypt.
Traditional infostealers have previously attempted to bypass this protection by running as SYSTEM or injecting code into the browser process to invoke IElevator::DecryptData via COM. However, these methods are relatively detectable by EDR telemetry.
Google introduced ABE in Chrome 127 in July 2024 to increase the difficulty of stealing cookies and other secrets by tying decryption to Chrome’s identity and a privileged elevation service.
This technique utilizes hardware breakpoints to access Chrome's v20_master_key directly from the browser memory.
The new technique, adapted from the open-source ElevationKatz project, involves attaching to Chrome or Edge as a debugger. It uses hardware breakpoints to intercept the v20_master_key when Chrome decrypts it to process ABE-protected data.
VoidStealer v2.0 initiates by spawning a hidden browser instance and attaching as a debugger, leveraging the fact that browsers typically load and decrypt cookies during startup. It identifies the necessary components and sets hardware breakpoints to capture the master key in plaintext.
Once the v20_master_key is obtained, the infostealer can decrypt any v20-prefixed ABE-protected cookies and credentials from browser SQLite databases, effectively bypassing ABE's security measures.
Defenders can detect this bypass through several stable behavioral patterns. It involves either launching a browser under a debugger or attaching a debugger to an existing process, which is unusual for non-developer software.
Monitoring for DebugActiveProcess, debug object handles, or unexpected parent processes for chrome.exe/msedge.exe can help identify suspicious activity. Additionally, correlating ReadProcessMemory calls against browser processes from untrusted binaries is a strong signal of malicious activity.
Most infostealers attempt to conceal the browser instance used for the bypass, making hidden or non-interactive browser sessions another important indicator. Telemetry pipelines that integrate process creation, debugger attachment, memory-access patterns, and hidden-window flags are well-equipped to detect this new class of ABE bypass.
Based on reporting by GBHackers.