Voidstealer 2.0 cracks chrome’s vault while google stays mute
Chrome’s memory is no longer sacred. A dormant Chrome process, invisible to the user, just woke up as a pickpocket. Gen Digital’s night-shift analysts caught the moment on 14 May: VoidStealer 2.0 hooked itself to the browser as a debugger, waited for the master encryption key to surface in plaintext during start-up, and vacuumed it before the first tab even blinked. No code injection, no noisy DLL, no traditional footprint—just a suspended process and perfect timing.
Abe bypassed in the wild for the first time
Application-Bound Encryption, Google’s flagship shield for cookies and passwords, is designed to chain secrets to the machine’s TPM. VoidSteaker sidesteps the chain entirely by reading the key while it is briefly unwrapped in RAM. Academics demoed the theory in 2022; this is the first time the trick ships in a crimeware toolkit advertised on Russian-speaking forums for $1,200 a month.
The malware lands via booby-trapped MSIX installers masquerading as Zoom updates. Once inside, it hunts the Chrome executable, spawns it with the --headless --no-sandbox flags suspended, then attaches via Windows Debugging API. The entire operation takes 0.8 seconds on an eight-core laptop, Gen Digital timed it. After extraction, the key is uploaded to a Tor-hosted drop point as a 4 KB JSON blob containing every stored credential, cookie and 2FA seed.
Traditional EDR tools miss the caper because no foreign code touches Chrome’s modules; the debugger interface is a legitimate Windows feature. VirusTotal scores the sample as “clean” on 67 of 72 engines. Gen Digital had to cross-correlate memory timestamps and ETW events to spot the anomaly.
Google’s silence amplifies the damage. No CVE assigned, no emergency patch, no Chrome blog post—just a boilerplate line to TechBloom: “We are aware and investigating.” Meanwhile, underground sellers are already bundling VoidStealer with a PowerShell module that automates the same dance against Edge and Brave, both Chromium cousins.
Users can blunt the attack by disabling Chrome’s background mode and wiping session data on exit, but that trades convenience for safety. The real fix requires Google to re-architect key unwrapping so it never surfaces in userland memory, a move the company has long deferred for performance reasons.
Gen Digital warns that 2.0 is a foundation, not a finale. Version 3.0, already teased, promises to weaponize the stolen key in real time, decrypting TLS traffic before it ever leaves the machine. Chrome’s vault door is open, and the locksmith is still en route.