A newly discovered remote access trojan (RAT) dubbed “Abe Office” is bypassing Chrome’s App-Bound Encryption feature to steal passwords and cookies from victims’ browsers. Disguised as an innocuous “office workstation helper,” the malware carries a newly issued code-signing certificate to appear legitimate.
Malware masquerade & deployment
The executable, named AbeAgent.exe, claims to be “Abe Office workstation helper”—a program that doesn’t actually exist. It was signed with a certificate issued by SSL.com under the name Kimberley Hankinson in Pennsylvania. The certificate became valid on October 26, 2026, and the malware was signed on November 4. Because it’s signed, it may bypass some basic security checks, even though none of that guarantees safety.
On its first launch, AbeAgent.exe copies itself into the user’s profile directory, restarts from there, and removes Windows’ “Mark of the Web” flag (which signals a file was downloaded). It then installs persistent methods: a Run key called “Abe Office Sync,” a scheduled task with the –autostart switch, and a firewall rule dubbed “Abe Office Agent.” These elements make sure the malware runs automatically on startup and keeps itself alive.
App-Bound Encryption defeat & credential exfiltration
A key part of what makes Abe Office dangerous is its ability to defeat App-Bound Encryption, a Chrome security feature introduced in Chrome 127 (July 2024) designed so that only the browser or its trusted component can decrypt stored credentials. Abe Office includes three encrypted add-ons (a hidden desktop module, a browser helper, and the main RAT), which it decrypts using a default password — “AbeOffice-ChangeMe.” That password unlocks all modules and even allows the offline derivation of network keys. Investigators were able to decrypt all modules and match the same key used by the malware’s command server. This means having a sample lets defenders unpick much of its behavior.
To steal credentials, the RAT makes a hidden Windows desktop, using browser sessions from copied Chrome and Edge profiles stored under C:\ProgramData\AbeOffice\SystemCache. When launched invisibly (positioned off-screen), these browsers are already signed in to email, banking, and shopping sites—letting attackers reuse those sessions without needing credentials. Then, via DLL injection and elevation services inside the browser, Abe Office retrieves the decryption key held by Chrome. It also includes backup paths such as a browser extension called “Abe Crypto Bridge.”
Scope & detection
Two command-and-control servers have been identified: one at 2.26.230[.]54 and another at 87.199.195[.]141. The first hosts the primary control panel, which also serves an update page named “Abe Update.” Security researchers uncovered over 130 related files across these servers — including multiple variants of AbeAgent.exe, stubs, and app.zips — first observed between mid-September and early November. Only the build using the real CA certificate seems brand new.
At least in testing, the malware delivered some actions: the operator accessed browsers on the hidden desktop and navigated to saved-password pages. The sandbox environment didn’t contain stored credentials, so nothing was actually stolen during tests—but the methods worked.
What to do: countermeasures
If you believe Abe Office infected your system, treat existing browser sessions as compromised. From a clean machine, log out of all services, reset passwords for important accounts (starting with email), enable two-factor authentication, and clean or reinstall the PC.
Detection tips include checking for folders like C:\ProgramData\AbeOffice, the presence of the “Abe Office Sync” Run registry key, any scheduled task or process started with –autostart, or browser windows launched at extremely negative screen coordinates (e.g. –window-position=-32000,-32000). Also monitor for non-browser applications accessing browser profile files (Cookies, Login Data, Local State). Block outbound traffic to the identified servers on port 9090.
Developed malware that defeats Chrome’s App-Bound Encryption is a serious escalation. This RAT doesn’t rely solely on privilege escalation but uses browser-based tricks and off-screen stealth to slip past defenses. As more malware moves toward hijacking saved credentials and sessions, organizations must harden detection capabilities around browser interactions and profile file security. Keep browser and OS updates current, monitor for unusual process behavior, and audit signed software that seems to offer unfamiliar services.
