Glove Stealer bypasses Chrome's App-Bound Encryption to steal cookies

Tags

External References

• https://www.gendigital.com/
• https://securityaffairs.com/
• https://otx.alienvault.com/

Description

Researchers have discovered a new .NET-based information stealer called Glove Stealer that targets browser extensions and local software to steal sensitive data like cookies, passwords, and cryptocurrency wallets. It uses a novel technique to bypass Chrome's App-Bound encryption by exploiting the IElevator service. The malware is distributed through phishing campaigns and requires administrative privileges to place its module in Chrome's Program Files directory. Once executed, it contacts a command-and-control server to exfiltrate harvested data.

Date