Vidar Browser Process Forking via NtCreateProcessEx with NULL SectionHandle

Ethan Andrews@eandrews

•updated Jun 22, 2026•0•0•6

Detects Vidar Stealer cloning a browser process (Chrome/Edge/Brave) using NtCreateProcessEx with a NULL SectionHandle to snapshot the browser address space for v20_master_key scanning as part of its Chrome Application-Bound Encryption (ABE) bypass chain.