Browser IElevator COM Interface Instantiated to Decrypt App-Bound Encryption Key

Subhankar H@Andrewsec57

•updated Jul 3, 2026•0•0•3

Detects registry access attempts to the CLSID registration entries for Chrome, Brave, and Edge IElevator COM interfaces. These interfaces are designed for browser-internal maintenance tasks. Adversaries, such as the operators of WEES Stealer, abuse these interfaces by invoking the IElevator DecryptData method via out-of-process COM activation to decrypt App-Bound encryption keys, bypassing standard browser security boundaries.