Named Pipe Creation/Connection: ChromeAppBoundVIP (WEES Stealer)

Subhankar H@Andrewsec57

•updated Jul 3, 2026•0•0•3

Detects the creation or connection to a named pipe containing the string 'ChromeAppBoundVIP', a behavior associated with the WEES stealer malware for extracting sensitive information from web browsers.