VoidStealer: Debugging Chrome to Steal Its Secrets

Key Points

VoidStealer is the first infostealer observed in the wild adopting a novel debugger-based Application-Bound Encryption (ABE) bypass technique that leverages hardware breakpoints to extract the v20_master_key directly from browser memory.

The bypass requires neither privilege escalation nor code injection, making it a stealthier approach compared to alternative ABE bypass methods.

In this technical blog post, we dissect the bypass technique step-by-step, from locating the target address for breakpoint placement to extracting the v20_master_key .

To support the defe…