Threat Actors Hosted ZeroCrumb Malware on GitHub That Steals Browser Cookies

Cybersecurity researchers have identified a new infostealer malware called “ZeroCrumb” that was recently distributed through GitHub repositories.

This sophisticated malware specifically targets browser cookies from popular browsers including Chrome, Brave, and Edge, enabling attackers to steal sensitive user authentication data without triggering User Account Control (UAC) alerts that typically warn users of suspicious activity.

The malware employs advanced techniques to extract encrypted credentials, potentially allowing threat actors to hijack active web sessions and gain unauthorized access to victims’ accounts.

ZeroCrumb operates by exploiting the browser’s internal security architecture, specifically targeting the encrypted storage mechanisms used to protect cookie data.

Unlike conventional cookie stealers that require administrative privileges, this malware implements a novel approach that circumvents standard security protections, making it particularly dangerous for corporate environments and individual users alike.

The malware can extract authentication tokens from compromised systems, potentially leading to account takeovers across multiple services simultaneously.

KrakenLabs researchers identified the threat after observing unusual data exfiltration patterns from several corporate networks.

Their analysis revealed that ZeroCrumb represents a significant evolution in cookie-stealing techniques, demonstrating the increasing sophistication of web-based credential theft.

The widespread adoption of browser-based applications for business and personal use makes this threat particularly concerning, as compromised cookies can provide attackers with immediate access to email, cloud storage, financial services, and corporate resources without needing to crack passwords or bypass multi-factor authentication.

Technical Mechanism

ZeroCrumb bypasses the Chrome Elevation Service through a technique called Transacted Hollowing, effectively impersonating a legitimate Chrome instance.

This impersonation allows the malware to interface with the IElevator COM interface to decrypt the App Bound Key, which is then used to access encrypted cookies.

The implementation utilizes named pipes that allow any program with Windows API access to connect to the ZeroCrumb pipe and extract the App Bound Key.

The malware can also be compiled as a DLL, embedding the key dumper in the resource section of the compiled library, allowing for more flexible deployment scenarios.

This approach makes detection particularly challenging as the malware mimics legitimate browser processes while performing its malicious activities.

Equip your SOC team with deep threat analysis for faster response -> Get Extra 𝗦𝗮𝗻𝗱𝗯𝗼𝘅 𝗹𝗶𝗰𝗲𝗻𝘀𝗲𝘀 for Free