EN PT-BR
← Voltar ao feed
high

Abe Office RAT abuses Chrome's App-Bound Encryption to decrypt browser cookies and gives operators hidden-desktop access

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 10:06 · coletado há 1 hora

A remote-access trojan posing as an “Abe Office workstation helper” pairs a hidden-desktop module with a browser stealer that asks Chrome's own elevation service to unwrap its App-Bound Encryption key. The loader AbeAgent.exe was reported by MalwareHunterTeam and carries a code-signing certificate issued to Kimberley Hankinson on November 4, 2026, which proves file integrity but not that the application is legitimate. Persistence relies on a Run value and a scheduled task that both restart the binary with --autostart. The stealer, internally labeled DC Styler, targets passwords, cookies, extensions and payment-card data in Chrome, Edge, Brave, Opera and Firefox, but researchers did not see it execute in the sandbox. Operators did open Chrome and Edge on an invisible desktop and reached their password pages, which held no saved passwords. The rating is high rather than critical because the stealer was not observed running, delivery is unknown and the record has no CVE or vendor advisory to verify; the technical details are as relayed by gbhackers.com, since the original Rogue Authority write-up did not surface in search.

Detalhes técnicos

  • The loader copies itself to %USERPROFILE%\AbeOffice, strips the Mark of the Web and persists through the “Abe Office Sync” Run value and a scheduled task.
  • Three encrypted add-ons provide the capabilities: AbeCapability.dll (RAT functions), AbeHvcn.dll (hidden desktop and injection) and AbeBrowserShim.dll (browser-key decryption).
  • The loader's unlock key was recovered offline from the default password AbeOffice-ChangeMe, which also protects network traffic, so captured communications can be decrypted.
  • The browser shim is injected into an off-screen Chrome started with --window-position=-32000,-32000; the browser's elevation service decrypts the App-Bound key, which is written to C:\ProgramData\AbeOffice\abe_job\key.dat.
  • The hVNC component copies Chrome and Edge profiles to C:\ProgramData\AbeOffice\SystemCache\ and opens them on an invisible desktop.
  • Command-and-control is 2.26.230[.]54:9090; 87.199.195[.]141 hosted a matching download page. VirusTotal links 133 files to this infrastructure, without proof that all share functionality.
  • No stealer execution, remote-shell activity or additional payload was observed. Delivery, attribution and the link between bootstrap loaders and archive packages remain unconfirmed.

Remediação

  • Hunt for AbeOffice directories, the Run value and scheduled task, connections to both servers, browser injection and off-screen launches with the window-position argument.
  • Correlate localhost remote-debugging activity with suspicious parent processes instead of treating it as malicious on its own.
  • On confirmed infections, isolate the endpoint, revoke browser sessions and reset important credentials from a clean device; treat session access from the affected machine as untrusted.

Linha do tempo

  1. gbhackers.com ↗ · pub. 09/11/2026 10:06 · coletado 09/11 12:00 primeiro registro

    Abe Office RAT abuses Chrome's App-Bound Encryption to decrypt browser cookies and gives operators hidden-desktop access

    ler a análise desta fonte

    A remote-access trojan posing as an “Abe Office workstation helper” pairs a hidden-desktop module with a browser stealer that asks Chrome's own elevation service to unwrap its App-Bound Encryption key. The loader AbeAgent.exe was reported by MalwareHunterTeam and carries a code-signing certificate issued to Kimberley Hankinson on November 4, 2026, which proves file integrity but not that the application is legitimate. Persistence relies on a Run value and a scheduled task that both restart the binary with --autostart. The stealer, internally labeled DC Styler, targets passwords, cookies, extensions and payment-card data in Chrome, Edge, Brave, Opera and Firefox, but researchers did not see it execute in the sandbox. Operators did open Chrome and Edge on an invisible desktop and reached their password pages, which held no saved passwords. The rating is high rather than critical because the stealer was not observed running, delivery is unknown and the record has no CVE or vendor advisory to verify; the technical details are as relayed by gbhackers.com, since the original Rogue Authority write-up did not surface in search.

    Technical Details

    • The loader copies itself to %USERPROFILE%\AbeOffice, strips the Mark of the Web and persists through the “Abe Office Sync” Run value and a scheduled task.
    • Three encrypted add-ons provide the capabilities: AbeCapability.dll (RAT functions), AbeHvcn.dll (hidden desktop and injection) and AbeBrowserShim.dll (browser-key decryption).
    • The loader's unlock key was recovered offline from the default password AbeOffice-ChangeMe, which also protects network traffic, so captured communications can be decrypted.
    • The browser shim is injected into an off-screen Chrome started with --window-position=-32000,-32000; the browser's elevation service decrypts the App-Bound key, which is written to C:\ProgramData\AbeOffice\abe_job\key.dat.
    • The hVNC component copies Chrome and Edge profiles to C:\ProgramData\AbeOffice\SystemCache\ and opens them on an invisible desktop.
    • Command-and-control is 2.26.230[.]54:9090; 87.199.195[.]141 hosted a matching download page. VirusTotal links 133 files to this infrastructure, without proof that all share functionality.
    • No stealer execution, remote-shell activity or additional payload was observed. Delivery, attribution and the link between bootstrap loaders and archive packages remain unconfirmed.

    Remediation

    • Hunt for AbeOffice directories, the Run value and scheduled task, connections to both servers, browser injection and off-screen launches with the window-position argument.
    • Correlate localhost remote-debugging activity with suspicious parent processes instead of treating it as malicious on its own.
    • On confirmed infections, isolate the endpoint, revoke browser sessions and reset important credentials from a clean device; treat session access from the affected machine as untrusted.