# Katz and Mouse Game:  MaaS Infostealers Adapt to Patched Chrome Defenses

Five MaaS infostealers bypass Chrome 127+ App-Bound Encryption via ChromeKatz memory scanning, COM elevation-service abuse, and DevTools remote debugging to steal cookies.

- Payout: Real-world hack
- Program: Google Chrome
- Credited: Jia Yu Chan,Salim Bitam,Daniel Stepanic,Samir Bousseaden,Cyril François,Seth Goodwin
- Disclosed: 2024-10-28
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/katz-and-mouse-game
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-katz-and-mouse-game
- Tags: domain:desktop impact:ato impact:data-leak kind:incident platform:threat-intel tech:chromium tech:windows technique:reverse-engineering technique:source-review vuln:privilege-escalation vuln:secrets-leak

**Target:** Chrome cookie store / app_bound_encrypted_key on Windows
**Root cause:** App-Bound Encryption only gates key release to the Chrome process; stealers either read CookieMonster plaintext from the network-service process memory, invoke GoogleChromeElevationService DecryptData via COM as SYSTEM, or enable remote debugging to dump cookies.
**Steps:**
1. STEALC: detect `v20` prefix in cookie DB, spawn embedded PE that creates hidden desktop via `CreateDesktopA`
2. Kill all chrome.exe, relaunch Chrome on hidden desktop, find network service via `--utility-sub-type=network.mojom.NetworkService`
3. Pattern-scan chrome.dll for `net::CookieMonster::~CookieMonster`, locate vtable, scan for CookieMonster instances
4. Walk CookieMap at +0x30 binary tree, `ReadProcessMemory` CanonicalCookieChrome structs, exfil plaintext cookies
5. METASTEALER: impersonate SYSTEM token, read `app_bound_encrypted_key` from Local State, CoCreateInstance CLSID `708860E0-F641-4611-8895-7D867DD3675B`, call `DecryptData`
6. PHEMEDRONE: launch Chrome with `--remote-debugging-port=9222 --window-position=-2400,-2400`, WebSocket `Network.getAllCookies`
7. XENOSTEALER: inject code into chrome.exe via SharpInjector to call DecryptData with the encrypted key
8. LUMMA: `CreateProcessW` Chrome, `NtReadVirtualMemory` chrome.dll, pattern-scan CookieMonster, dump cookies, exfil xor+base64 zips to C2
**How found:** Elastic observed atypical STEALC samples with embedded 64-bit PE and `v20` cookie prefixes, pivoted signature patterns to ChromeKatz source, and compared old/new binaries across families to identify each bypass implementation.
**Exploitation:** Infostealers deployed post-social-engineering run in victim user context; they terminate/relaunch Chrome, abuse the elevation service or read process memory to recover plaintext cookies, then exfiltrate to C2 for session hijacking and account takeover.
**Escalation:** METASTEALER/XENOSTEALER escalate to SYSTEM via token impersonation to reach the elevation service; stolen cookies enable account takeover and financial asset transfer.
**Insight:** When a vendor gates a secret behind a privileged broker process, look for the broker's COM CLSID and whether callers are authenticated by identity or merely by process context; also check whether the plaintext still lives in a child process (network service) reachable via ReadProcessMemory.