Chrome’s master key slips out in the wild as voidstealer 2.0 learns to pick the browser’s lock

While you were opening your first tab this morning, a piece of malware was already whispering to Chrome, coaxing the browser to hand over its most guarded secret: the master key that guards every saved password, cookie and credit-card number. Security researchers at Gen Digital caught the thief red-handed, baptized it VoidStealer 2.0, and warned that the technique has moved from conference slides to live plunder.

The heist happens at boot, in milliseconds

Forget code injection. VoidStealer 2.0 spawns Chrome as a suspended ghost process, attaches to it like a debugger, then freezes time. The instant the browser decrypts its vault in memory—milliseconds after launch—the malware photographs the plaintext key and vanishes. No hooks, no overwritten DLLs, no noisy disk footprint. Antivirus engines that hunt for classic indicators are left staring at a perfectly healthy-looking Chrome.exe.

What makes the stunt brutal is its timing. Chrome’s Application-Bound Encryption (ABE) was supposed to tie secrets to the machine’s TPM, rendering bulk memory dumps useless. VoidSteaker simply waits for the moment ABE unwraps the data, then pickpockets it. The browser never notices; the operating system never blinks.

Gen Digital’s telemetry shows the first野外 samples circulating in cracked-game torrents and fake Photoshop installers. Once inside, the stealer ships the loot to a Telegram channel where credentials are auctioned by the thousands. Price list: cookies $5, logins $15, full profiles with 2FA bypass $80.

Google’s security team has remained silent since Gen shared its report last Thursday. No emergency patch, no reassuring blog post—just the usual stale promise of “investigations are ongoing.” Meanwhile, Chromium’s public bug tracker carries no entry for the issue, leaving 3.2 billion users in the dark.

The academic world saw this coming. In 2022, TU Graz researchers outlined “Sleepy Chrome” attacks in a paper that gathered dust. VoidStealer’s authors read the footnotes, wrote the code, and cashed in. The gap between theory and criminal reality has never felt shorter.

Until Google ships a fix, the only seatbelt available is a blunt one: shut down Chrome every time you step away, or run it inside a disposable virtual machine. Paranoid? Tell that to the 1,700 people whose wallets are already draining on the dark-web shelf.