Abe Office RAT bypasses Chrome App-Bound Encryption via browser injection

What happened

A remote-access trojan posing as an “Abe Office workstation helper” was analysed by researchers at Rogue Authority, as reported by Cyber Security News and GBHackers. Both outlets say it combines hidden-browser control with tooling meant to get around Chrome’s App-Bound Encryption.

How the bypass works. GBHackers reports that the malware does not break the cryptography. Its browser stealer injects a helper into Chrome and asks for decryption from inside the trusted browser process. Both outlets say Google added App-Bound Encryption for Windows cookies in Chrome 127. Cyber Security News dates that to July 2024 and notes that Google named code injection as a remaining, noisier route. According to both outlets, Abe Office takes that route:

• It launches a browser off-screen and injects its helper DLL, AbeBrowserShim.dll.
• The helper asks the browser’s elevation service to decrypt the App-Bound key.
• The result is written to C:\ProgramData\AbeOffice\abe_job\key.dat.

The sample. The file is AbeAgent.exe. GBHackers credits MalwareHunterTeam with identifying it. It says the investigation was produced by Claude, operating through Claude Code on a REMnux virtual machine.

• Both outlets say it is signed with an SSL.com code-signing certificate in the name of Kimberley Hankinson, signed on November 4, 2026.
• Cyber Security News adds that the certificate became valid on 26 October 2026 and has been reported to the CA and added to the CertGraveyard.
• Both outlets stress that a signature shows who signed a file and that it was not altered. It does not show the software is legitimate.

Install and persistence.

• The loader copies itself into %USERPROFILE%\AbeOffice\ and removes the Mark of the Web.
• It adds an “Abe Office Sync” Run value and a scheduled task, both launching the executable with --autostart (GBHackers).
• Cyber Security News also reports an attempt to add a firewall rule named “Abe Office Agent”.

Add-ons. Three encrypted add-ons provide the capabilities:

• AbeCapability.dll handles RAT functions.
• AbeHvcn.dll provides hidden-desktop access.
• AbeBrowserShim.dll requests the browser-key decryption.

Researchers recovered the unlocking key offline using the embedded default password AbeOffice-ChangeMe. The same password underpins the network encryption, so captured traffic can be decrypted.

Stealer and hidden desktop. GBHackers says the stealer, labeled “DC Styler”, contains routines for passwords, cookies, extensions and payment-card data across Chrome, Edge, Brave, Opera and Firefox. It adds that the App-Bound bypass does not apply to Firefox’s separate protection model. The hidden-desktop component copies Chrome and Edge profiles into C:\ProgramData\AbeOffice\SystemCache\ and opens them on an invisible Windows desktop. Cyber Security News reports 287 profile files copied in the sandbox. Opening a copied profile gives the operator access to existing signed-in sessions from the victim’s own machine.

What was observed.

• In sandbox testing, the operator opened Chrome and Edge and went straight to the saved-password pages. Cyber Security News says this happened across three connections over about a day and a half.
• The sandbox profiles held no saved passwords.
• GBHackers states researchers did not observe the cookie-stealing component execute, nor remote-shell activity or additional payload deployment.

Infrastructure. Both outlets name the primary command-and-control endpoint as 2.26.230[.]54 on port 9090. A second server, 87.199.195[.]141, hosted a matching download page. VirusTotal links 133 files to the infrastructure. GBHackers cautions that this does not mean every file shares identical functionality. Cyber Security News breaks them down as 10 other AbeAgent.exe files, 61 launcher-bootstrap-stub.exe files and 49 app.zip packages.

Still unknown. Delivery is unknown. GBHackers says attribution and the full infection chain remain unresolved, and the suspected link between bootstrap loaders and archive packages is unconfirmed. No CVE is cited in either source, and neither describes a Chrome patch.

Am I affected?

You are potentially affected only if AbeAgent.exe, or a program calling itself the “Abe Office workstation helper”, was run on a Windows machine. The sources say the delivery method is not confirmed, so there is no known way to tell exposure from the infection route alone. Check endpoints for these indicators, which both outlets list:

• AbeOffice folders under %USERPROFILE% and C:\ProgramData.
• The “Abe Office Sync” Run value and a scheduled task launching a process with --autostart.
• Connections to 2.26.230[.]54 or 87.199.195[.]141.
• Browsers launched with --window-position=-32000,-32000, or browser injection.

GBHackers adds that localhost remote debugging should be correlated with suspicious parent processes, not classified as malicious on its own. Hashes for AbeAgent.exe and the three add-ons are in the indicator table in the GBHackers article.

Exploitation outside a sandbox is not confirmed in the sources.

What to do now

1. Search endpoints for the AbeOffice directories, the “Abe Office Sync” Run value, the related scheduled task, and any process started with --autostart.
2. Review network logs for connections to 2.26.230[.]54 and 87.199.195[.]141. Cyber Security News advises blocking outbound traffic to both servers on port 9090. GBHackers ties port 9090 only to the primary server, so consider blocking both addresses more broadly.
3. Flag browsers started with --window-position=-32000,-32000, browser injection, and non-browser programs reading Chrome’s Login Data, Cookies and Local State files, as Cyber Security News suggests.
4. For a confirmed infection, isolate the endpoint. From a clean device, revoke browser sessions and reset important credentials, starting with email. Cyber Security News also recommends enabling two-factor authentication and cleaning or reinstalling the PC.
5. Do not treat a session coming from a user’s own device as trustworthy by default, since the hidden-desktop component reuses existing signed-in sessions (GBHackers).

Sources

• GBHackers: New Abe Office Malware Tricks Chrome Into Decrypting Its Own Protected Browser Cookies
• Cyber Security News: New Abe Office Malware Bypasses Chrome App-Bound Encryption to Steal Browser Passwords and Cookies