New Abe Office Malware Tricks Chrome Into Decrypting Its Own Protected Browser Cookies

A newly analyzed remote-access trojan masquerading as an “Abe Office workstation helper” combines hidden-browser control with tooling designed to bypass Chrome’s App-Bound Encryption.

Rather than breaking the cryptography, its browser stealer injects a helper into Chrome and requests decryption from inside the trusted browser process.

The supplied analysis credits MalwareHunterTeam with identifying the sample, AbeAgent.exe, and states that Claude, operating through Claude Code on a REMnux virtual machine, produced the investigation.

Sandbox testing exposed interactive operator activity, although researchers did not observe the cookie-stealing component execute.

AbeAgent.exe carries an SSL.com code-signing certificate issued in Kimberley Hankinson’s name and was signed on November 4, 2026.

Its browser helper carries the same certificate. The signature identifies the signer and protects file integrity; it does not establish that the purported office application is legitimate.

After execution, the loader copies itself into %USERPROFILE%AbeOffice, removes Mark of the Web, and establishes persistence through the “Abe Office Sync” Run value and a scheduled task. Both launch the executable with --autostart.

Three encrypted add-ons provide the operational capabilities: AbeCapability.dll handles RAT functions, AbeHvcn.dll supplies hidden-desktop access and injection, and AbeBrowserShim.dll requests browser-key decryption.

Although the loader demands an unlocking key from its server, researchers recovered it offline using the embedded default password AbeOffice-ChangeMe.

The same password underpins network encryption, allowing captured communications to be decrypted.

Google introduced App-Bound Encryption for Windows cookies in Chrome 127. Its privileged service validates the requesting application before releasing protected data, preventing unrelated applications from simply decrypting Chrome’s secrets.

Google explicitly identified browser injection as a remaining attack route, albeit one that increases detection opportunities.

Abe Office Malware

Rogue Authority Researchers said that, Abe’s implementation follows that route. It launches an off-screen browser, injects AbeBrowserShim.dll, and asks the browser’s elevation service to decrypt its App-Bound key.

The helper writes the result to C:ProgramDataAbeOfficeabe_jobkey.dat.

The stealer, internally labeled “DC Styler,” contains collection routines targeting passwords, cookies, extensions, and payment-card data across Chrome, Edge, Brave, Opera, and Firefox.

Its App-Bound bypass targets supported browser implementations, not Firefox separate protection model.

The hVNC component copies Chrome and Edge profiles into C:ProgramDataAbeOfficeSystemCache and opens them on an invisible Windows desktop.

This gives operators a route to interact with existing sessions from the compromised machine.

During extended sandbox observation, the operator opened both browsers and navigated directly to their password-management pages.

The profiles contained no saved passwords. Researchers reported no observed stealer execution, remote-shell activity, or additional payload deployment.

The primary command-and-control endpoint was 2.26.230[.]54:9090. A second server, 87.199.195[.]141, hosted a matching download page.

VirusTotal associations connected 133 files to the infrastructure, but those links do not establish that every file shares identical functionality.

Defenders should investigate AbeOffice directories, its persistence artifacts, connections to both servers, browser injection, and off-screen launches using --window-position=-32000,-32000.

Localhost remote debugging warrants correlation with suspicious parent processes rather than standalone classification.

For confirmed infections, isolate the endpoint, revoke browser sessions, and reset important credentials from a clean device.

Delivery remains unknown, and the suspected relationship between associated bootstrap loaders and archive packages remains unconfirmed.

The observed activity supports a credential-focused operation, but attribution and the full infection chain remain unresolved. Session access from the victim’s device should not be treated as inherently trustworthy.

Indicators of compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.