Vidar Infostealer Bypasses Chrome ABE, Threatens User Data

The Vidar Infostealer, a prominent malware-as-a-service (MaaS), has successfully developed and implemented a sophisticated technique to bypass Google Chrome's Application-Bound Encryption (ABE), a critical security feature introduced in Chrome 127 in July 2024. ABE was designed by Google to protect browser-stored cookies and sensitive credentials by tying the encryption to the specific application, making it significantly harder for malware to decrypt data outside the legitimate Chrome process. According to findings by Gen Threat Labs, corroborated by multiple cybersecurity firms, the latest iterations of Vidar, specifically Vidar 2.0, are employing a complex chain of evasion techniques. These include process forking, meticulous memory pattern scanning, and Asynchronous Procedure Call (APC) injection to directly extract the browser's master decryption key from live memory. This bypass method is particularly concerning because it allows the infostealer to access and exfiltrate sensitive data, such as saved passwords, credit card details, and session cookies, which would otherwise be protected by ABE. Vidar's approach to locating the encrypted master key in memory involves scanning the entire memory space of a running browser for specific patterns. Once identified, it uses APC injection to execute the `CryptUnprotectMemory` function from within the live browser process, thereby decrypting the key. To further enhance stealth and avoid forensic traces, Vidar creates a second fork of the browser process to read the decrypted key and then injects a follow-up APC to re-encrypt the key in memory, restoring the browser's original state. This technique is noted for its ability to bypass traditional code injection detection methods by exploiting legitimate Windows APC mechanisms. APC injection allows the malware to execute arbitrary code within the address space of a separate, legitimate process, often slipping past endpoint detection systems that are not specifically tuned to monitor such nuanced behaviors. The Vidar Infostealer, first identified in 2018, has continuously evolved. Vidar Stealer 2.0, released in October 2025, represents a significant upgrade, featuring a complete rewrite from C++ to pure C. This redesign incorporates a multithreaded architecture, which dramatically improves the efficiency and speed of data collection and exfiltration, allowing it to leverage modern multi-core processors. Its enhanced anti-analysis features, including debugger detection and rapid self-deletion, also pose additional challenges for detection and investigation. Vidar systematically targets a broad range of data, including credentials from various browsers (Chrome, Firefox, Edge, and other Chromium-based browsers), cloud services, cryptocurrency wallets, gaming platforms, and communication applications like Discord and Telegram. The malware is distributed through various means, including malicious spam emails, cracked software websites, malicious ads, and websites impersonating legitimate brands. Recent campaigns have also utilized malvertising and fake GitHub repositories exploiting code leaks to deliver the infostealer. The threat posed by Vidar is global, affecting individuals and small to midsize businesses (SMBs) across continents, including the US and Europe. India's Computer Emergency Response Team (CERT-In) has also issued advisories regarding info-stealer malware, including Vidar, highlighting its relevance and potential impact on Indian users. Given the widespread use of Google Chrome, this bypass poses a significant risk to user data integrity and privacy worldwide. Cybersecurity professionals and users are advised to adapt their detection strategies and practice strong cybersecurity hygiene, including using robust endpoint security, multi-factor authentication, and being vigilant against phishing and malicious downloads.

Frequently Asked Questions

Read Full Story on Quick Digest