Vidar Stealer Chrome/Edge/Brave Process Enumeration and Fork for ABE Bypass

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects instances of Chrome, Edge, or Brave browsers being launched with specific, suspicious command-line arguments (e.g., --no-first-run, --disable-gpu, about:blank) from parent processes that are not standard browser or update launchers. This behavior is indicative of Vidar Stealer attempting to force a browser instance to generate or expose the master encryption key, facilitating the theft of browser-stored credentials.