New VoidStealer Variant Bypasses Chrome ABE Without Injection or Privilege Escalation

A new VoidStealer v2.0 variant (first seen March 13, 2026) uses a debugger-based technique to bypass Chrome's Application-Bound Encryption (ABE) without injecting code or needing SYSTEM privileges, by setting hardware breakpoints to capture the transient plaintext v20_master_key from browser memory; it is distributed as Malware-as-a-Service, targets Chrome and Edge, and includes a provided IOC hash.