REVSTEALER Chrome/Edge App-Bound Key Theft via Debug Launch

Arnold Chan@slaz

•updated Sep 7, 2026•2•0•1

Detects potential credential harvesting or process memory manipulation against browser processes (Chrome or Edge). The rule monitors for unauthorized debugging activity initiated against browser processes (e.g., using flags like DEBUG_PROCESS or specific API calls) and the access of the App-Bound encryption provider symbol, which is often a target for attackers seeking to decrypt browser-stored secrets.