Voidstealer 2.0 cracks chrome's encryption shield in live attacks

Security researchers at Gen Digital caught VoidSteaker 2.0 red-handed last week, lifting chrome's master encryption key straight from RAM while the browser boots—no code injection, no loud footprints, just a suspended chrome process acting as an involuntary accomplice.

How the heist works

The malware spawns a hidden chrome child, attaches itself as a debugger and waits for the instant Application-Bound Encryption decrypts user secrets. In that micro-window the material is plaintext; VoidSteal snaps the key and vanishes, leaving antivirus engines staring at an apparently untouched executable.

What rattles defenders is the technique's pedigree. Memory-safe key extraction from a browser sandbox has been sketched in conference halls for years, yet no one expected to see it weaponized in the wild before the patch cycle caught up. Google has not published a fix timeline, and the Chromium tracker remains silent, a vacuum that opportunistic crews will fill within days.

Chrome's ABE mechanism was supposed to bind cryptographic material to the Windows user profile, making bulk data theft impractical. VoidStealer sidesteps that promise by acting as the debugger Chrome itself authorizes during startup, inheriting the same memory visibility the browser uses to profile its own internals. The attack is surgical: no dropped DLL, no registry edit, no suspicious named pipe—just a suspended thread and a timely read operation.

For enterprises the takeaway is stark: endpoint detection that relies on behavioral anomalies tied to injection primitives will miss this. The only reliable telemetry comes from unsolicited debugger attachment events, a signal most fleets do not log. Meanwhile, consumer passwords, cookies and 2FA seeds flow through the clipboard of a process that looks exactly like legitimate Chrome.

Gen Digital confirms the sample is already circulating in commodity malware channels, priced below three hundred dollars on low-tier forums. Expect copycats before the month ends. Google can throttle the vector by tightening debugger ACLs at launch, but every day of silence hands attackers a fresh batch of unprotected sessions. The clock started last Tuesday; the count of exposed vaults ticks upward each hour.