Trending Now - Voidstealer Malware Exploits Debugger to Steal Chrome Key

WHO:

Gen Digital, the parent company behind Norton, Avast, AVG, and Avira brands.

Vojtěch Krejsa, threat researcher at Gen Digital.

WHAT:

VoidStealer is an information stealer malware that uses a new approach to bypass Chrome’s Application-Bound Encryption (ABE).

VoidStealer extracts the v20_master_key directly from the browser's memory.

This is the first case of an infostealer observed in the wild using a debugger-based ABE bypass technique.

VoidStealer was advertised on dark web forums since at least mid-December 2025.

The new ABE bypass mechanism was introduced in VoidStealer version 2.0.

WHERE:

The malware is discussed in the context of Google Chrome, which is used globally.

WHEN:

Google introduced ABE in Chrome 127, released in June 2024.

VoidStealer version 2.0 was introduced in December 2025.

WHY:

The malware targets a moment when Chrome’s v20_master_key is briefly present in memory in plaintext state during decryption operations.

HOW:

VoidStealer starts a suspended and hidden browser process and attaches it as a debugger.

It scans the browser DLL (chrome.dll or msedge.dll) for a specific string and sets a hardware breakpoint.

The malware waits for the breakpoint to trigger during browser startup while decrypting protected data.

It reads the register holding a pointer to the plaintext v20_master_key and extracts it using ‘ReadProcessMemory.’

The technique appears to be based on the open-source project ‘ElevationKatz,’ part of the ChromeKatz cookie-dumping toolset.

(UPDATED March 23, 2026 04:02 UTC)

In a significant cybersecurity development, Gen Digital, the parent company of Norton and Avast, has identified a new malware called VoidStealer, which employs a novel technique to bypass Google Chrome's Application-Bound Encryption. This information stealer targets the v20_master_key while it is briefly exposed in memory during decryption operations, marking the first instance of such a method being used in the wild. VoidStealer, which has been advertised on dark web forums since mid-December 2025, utilizes a debugger-based approach to extract sensitive information directly from the browser's memory.