VoidStealer — Debugger-Based Chrome ABE Bypass

VoidStealer ("The Void") is a Malware-as-a-Service infostealer sold via Telegram/underground forums and run across multiple simultaneous campaigns in 2026. Its v2.0 variant (first seen 2026-03-13) is the first malware observed in the wild to weaponize a debugger-based technique against Chrome's Application-Bound Encryption (ABE): instead of injecting into the browser or escalating to SYSTEM, it launches the browser hidden/suspended, attaches as a debugger, sets a hardware breakpoint on the ABE decrypt routine, and reads the v20_master_key straight from a CPU register — defeating ABE with neither code injection nor privilege escalation.

Mechanically: it calls CreateProcessW with CREATE_SUSPENDED + SW_HIDE, DebugActiveProcess to attach, sets DR0/DR7 (hardware breakpoint) on LEA RCX, OSCrypt.AppBoundProvider.Decrypt.ResultCode (string found in the browser's .rdata), then on the breakpoint reads v20_master_key from R14 (Edge) / R15 (Chrome) via ReadProcessMemory. It evades EDR with direct/Zw-prefixed ntdll syscalls resolved at runtime, dynamic API resolution (no import table), XOR-encrypted config, and a mutex-based sandbox check. C2 uses a Steam profile as a dead-drop resolver (server address embedded in the display name) fronted by an intermediate portal. It follows a grab-and-go model — collect, exfil, exit — leaving minimal persistence.

Defender priority: The technique's tell is loud even though the syscalls are quiet — a non-browser process launching chrome.exe/msedge.exe hidden off-screen (--window-position=-32000,-32000, --no-sandbox, --disable-extensions) and then debugging it / reading its memory. Hunt for that lineage plus reads of Local State / Login Data by non-browser code. Because ABE is bypassed at user level, treat any hit as cookie + credential theft: invalidate sessions and rotate, don't just reset passwords.

Web-hunter note: One v2.0 sample SHA-256 was published (Gen Digital); SOCRadar references additional MD5s in a gated whitepaper not reproduced here. The hunts therefore lead with behavior (hidden-browser-launch + debug + memory-read), which survives repacking, and pin the published hash/domain/SteamID as exact IOCs.

Hunt hypotheses (ordered by fidelity)

1. H1 (high): A non-browser process launches chrome.exe/msedge.exe with off-screen + --no-sandbox + --disable-extensions flags. → Q1
2. H2 (high): A browser process is spawned by an anomalous parent (not explorer/user shell/launcher) then immediately debugged. → Q2
3. H3 (high): A non-browser process reads Chrome/Edge Local State or Login Data (key + cred extraction). → Q3
4. H4 (high): Endpoint connects to the known C2 domain or the Steam dead-drop resolver from a non-gaming process. → Q4
5. H5 (high): Execution of the known VoidStealer v2.0 SHA-256. → Q5
6. H6 (medium): A process reads crypto-wallet / Telegram / Discord token files in a single short burst (grab-and-go). → Q6
7. H7 (medium): steamcommunity.com contacted by a process that never renders a UI / from a server endpoint. → Q4, Q7

Attack chain

Values are source-attributed (Gen Digital / SOCRadar). Behavior-first: the launch-flags + debug + memory-read chain is the durable signal; the hash/domain/SteamID are exact but perishable.

• Sysmon Event ID 10 (ProcessAccess): Hunt for a non-browser SourceImage opening chrome.exe/msedge.exe with GrantedAccess including PROCESS_VM_READ (0x10) / debug rights — the strongest local tell of the memory-read step that direct syscalls can hide from EDR hooks.
• Sysmon Event ID 1: Browser launched with the off-screen + --no-sandbox flag combo by an unexpected parent.
• IdP / SSO sign-in logs: After any endpoint hit, hunt for session-cookie replay — sign-ins from new ASN/geo reusing an existing session token (impossible travel, no MFA prompt).
• Proxy / DNS logs: Connections to citrusshop.icu and steamcommunity.com from server or non-gaming endpoints; JSON POSTs to newly-registered domains.

Pair the IOAs with a Sysmon EID 10 (ProcessAccess) rule for non-browser PROCESS_VM_READ on browsers — it catches the memory-read even when direct syscalls evade Falcon's userland hooks.

• Telemetry ready: Confirm ProcessRollup2 CommandLine capture is enabled and FileOpenInfo flows; deploy Sysmon EID 10 to cover the memory-read step that direct syscalls can hide.
• Benign baseline: Run Q2/Q3/Q6/Q7 for 7 days; catalog legitimate browser automation, backup/password agents, and Steam usage; build exclusions.
• Positive tests: Launch chrome.exe --window-position=-32000,-32000 --no-sandbox from a script to confirm Q1; read Local State with a non-browser test tool to confirm Q3.
• Promotion: Q1 and Q5 → Custom IOA/IOC first; Q3 → Detect after baselining approved key-store readers.

1 · Disable browser password manager (Chrome/Edge GPO registry)

# HKLM policies - removes saved creds VoidStealer would decrypt
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v PasswordManagerEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge"  /v PasswordManagerEnabled /t REG_DWORD /d 0 /f

2 · Sysmon ProcessAccess rule for browser memory reads

<Sysmon schemaversion="4.90">
 <EventFiltering>
  <RuleGroup groupRelation="or">
   <ProcessAccess onmatch="include">
    <TargetImage condition="end with">chrome.exe</TargetImage>
    <TargetImage condition="end with">msedge.exe</TargetImage>
   </ProcessAccess>
  </RuleGroup>
 </EventFiltering>
</Sysmon>
<!-- Then alert where SourceImage is NOT a browser and GrantedAccess includes 0x10 (PROCESS_VM_READ) -->

3 · Block C2 at the proxy (Squid example)

# /etc/squid/voidstealer.acl
acl void_c2 dstdomain citrusshop.icu
http_access deny void_c2

Validation: The behavioral chain (hidden browser → key-store read → C2) is well covered and promotable. The residual gap is the userland-hook-evading syscall layer — close it with Sysmon EID 10 (memory-read visibility) and IdP-side cookie-replay hunting (s7) rather than relying on EDR API hooks alone.