Bypass Record
LSASS Credential Dumping × Google Chrome
A publicly-reported instance of LSASS Credential Dumping bypassing Google Chrome, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
VoidStealer uses a novel method to circumvent Chrome's App-Bound Encryption, which is designed to tie encryption keys to the application identity. The malware likely operates with user-level privileges and exploits the way Chrome handles decryption requests, enabling it to extract and decrypt protected data without triggering endpoint detection.
Detection & mitigation
Monitor for suspicious processes accessing Chrome's Local State or Cookies files, especially from non-browser processes. Deploy endpoint detection rules for unusual file reads to browser profile directories and enforce application control to block untrusted executables.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.