New Abe Office Malware Bypasses Chrome App-Bound Encryption to Steal Browser Passwords and Cookies

A new remote-access trojan called Abe Office can steal browser passwords and cookies, even from Chrome’s App-Bound Encryption. It poses as an office helper tool and carries a valid code-signing certificate.

Researchers at Rogue Authority broke its weak protections and watched the operator at work in a sandbox.

Abe Office malware

The file is named AbeAgent.exe and calls itself the “Abe Office workstation helper.” No such product exists. The file is signed through SSL.com in the name of a private person, Kimberley Hankinson, in Pennsylvania. The certificate became valid on 26 October 2026 and the file was signed on 4 November.

A signature only shows who sealed a file and that nobody changed it afterward. It does not prove the file is safe. A brand-new certificate in a person’s name, used at once to sign a “company” product, is a pattern researchers see again and again in signed malware. The certificate has been reported to the CA and added to the CertGraveyard.

The name “Abe” most likely stands for App-Bound Encryption, the Chrome feature the malware is built to beat.

On first run, the program copies itself to the user’s profile folder and restarts from there. It removes the Mark of the Web tag, which is the hidden label Windows uses to warn about downloaded files.

It then adds a Run key named “Abe Office Sync” and a scheduled task, both starting it with the switch –autostart. It also tries to add a firewall rule called “Abe Office Agent.”

Three encrypted add-ons are written to disk. One is the main RAT, one runs the hidden desktop, and one is a small helper that runs inside the browser. Before loading them, the starter asks its server for a key. The goal is to hide the add-ons from anyone who has only the file.

According to technical research published by Rogue Authority, the lock does not hold. The file contains a default password, AbeOffice-ChangeMe, which can be used to work out every key. Researchers decrypted all three add-ons this way. The key sent by the live server matched the one they had computed offline.

The same password protects the network traffic. The AES key is just a hash of that password, so the whole captured conversation could be read. This is good news for defenders, since anyone holding a sample can unpack the kit.

The hidden desktop add-on creates an invisible Windows desktop and starts browsers on it. It first copies the victim’s Chrome and Edge profiles to C:ProgramDataAbeOfficeSystemCache. In the sandbox it copied 287 profile files. A browser opened from those copies is already signed in to email, banking and shopping sites.

This lets the operator act as the victim without a password, and from the victim’s own PC. That helps get past “new device” checks. Hidden-desktop tools like this are growing in number, as shown by our earlier report on Shadow hVNC, which also steals cookies and reuses live sessions.

In a multi-day sandbox run, the operator connected three times over about a day and a half. The operator listed the browsers, opened Chrome and Edge on the hidden desktop, and went straight to the saved-password pages. The sandbox held no saved passwords, so nothing was taken.

Google added App-Bound Encryption in Chrome 127 in July 2024. A Windows service with system rights checks which app is asking before it gives up the key. Google said malware would now need system rights or code injection, which are noisier actions. Google’s security blog explains the design.

Abe Office takes the second route. It starts a browser off-screen at position -32000,-32000 and injects its helper DLL. The helper asks the browser’s own elevation service to decrypt the key. Because the request comes from the real browser, the service agrees.

The key is saved to C:ProgramDataAbeOfficeabe_jobkey.dat. The code also holds backup routes, including a browser extension named “Abe Crypto Bridge.”

Other stealers use similar tricks. SpyCloud found that families such as Lumma and Vidar claimed bypasses soon after launch. Phemedrone used Chrome’s remote debugging port. Our earlier story on infostealers bypassing Chrome’s cookie protection covers Elastic’s findings on these methods. A recent Marsalek malware report shows the same DLL injection idea.

The command server at 2.26.230[.]54 also hosts the operator’s control panel. Shodan data showed its Windows computer name matched the one that drove the hidden browsers. Its port 80 served an “Abe Update” page listing the kit’s files.

A second server, 87.199.195[.]141, served the same page. VirusTotal links 133 files to the two servers, first seen between mid-September and early November.

They include 10 other AbeAgent.exe files, 61 launcher-bootstrap-stub.exe files and 49 app.zip packages. Only this build uses a certificate from a real CA, so it may be the newest step. The delivery method is still unknown.

If you ran this file, treat your browser sessions as stolen. From a clean device, sign out of all sessions, change passwords for key accounts starting with email, and turn on two-factor authentication. Then clean or reinstall the PC.

Defenders should look for the AbeOffice folders, the “Abe Office Sync” Run value and any process started with –autostart. They should block outbound traffic to both servers on port 9090.

They should also flag browsers launched with –window-position=-32000,-32000 or with local remote debugging, and non-browser programs reading Login Data, Cookies and Local State files. A sign-in from the victim’s own PC should not be trusted by default either.

The post New Abe Office Malware Bypasses Chrome App-Bound Encryption to Steal Browser Passwords and Cookies appeared first on Cyber Security News.