[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fROnHKKmc-GHZkmfnbULWMBRf-YiaNsolI5pGrARGUks":3},{"article":4,"iocs":49,"watch_terms":55,"solutions":56,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4abe484c-f9aa-4140-a860-9b3a8597d83e","New Abe Office Malware Bypasses Chrome App-Bound Encryption to Steal Browser Passwords and Cookies","new-abe-office-malware-bypasses-chrome-app-bound-encryption-to-steal-browser-pas-add9dd","A new remote-access trojan called Abe Office can steal browser passwords and cookies, even from Chrome’s App-Bound Encryption. It poses as an office helper tool and carries a valid code-signing certificate. Researchers at Rogue Authority broke its weak protections and watched the operator at work in a sandbox. Abe Office malware The file is named […] The post New Abe Office Malware Bypasses Chrome App-Bound Encryption to Steal Browser Passwords and Cookies appeared first on Cyber Security News.","A new remote-access trojan named Abe Office has been discovered that can steal browser passwords and cookies by bypassing Chrome's App-Bound Encryption. The malware, disguised as an office helper tool, uses a valid code-signing certificate and weak protections that researchers were able to break. It operates by creating a hidden desktop and injecting a helper DLL into browsers to trick the elevation service into decrypting sensitive data.","Abe Office malware bypasses Chrome's encryption to steal passwords and cookies.","https:\u002F\u002Fcybersecuritynews.com\u002Fabe-office-malware\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FAbe-Office-malware.webp","2026-11-09T17:58:44+00:00","2026-11-09T18:00:25.144541+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"Chrome","product",{"name":21,"type":19},"Edge",{"name":23,"type":24},"Google","vendor",{"name":26,"type":27},"App-Bound Encryption","technology",{"name":29,"type":30},"Abe Office","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,52],{"type":35,"value":29,"context":51},"Name of the discovered remote-access trojan.",{"type":35,"value":53,"context":54},"AbeAgent.exe","Executable file name for the Abe Office malware.",[23,18],{"controls":57,"vendors":131},[58,79,105],{"slug":59,"name":60,"problem":61,"products":62},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[63,71],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":80,"name":81,"problem":82,"products":83},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[84,92,97],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":93,"product_name":94,"url":95,"description":96},"app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":127,"product_name":128,"url":129,"description":130},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[132],{"slug":133,"name":23,"logo_path":134,"roles":135},"google","\u002Fvendor-logos\u002Fgoogle.png",[136],"affected",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"abe-office-rat-bypasses-chrome-encryption-to-harvest-browser-credentials","Abe Office RAT Bypasses Chrome Encryption to Harvest Browser Credentials","The Abe Office malware succeeds by masquerading as a legitimate office productivity tool, complete with a valid code-signing certificate, exploiting the trust users and security tools place in signed software. By injecting a helper DLL into the browser process and abusing Chrome's App-Bound Encryption elevation service, it silently decrypts and exfiltrates stored passwords and cookies without triggering obvious alerts. This matters because browser-stored credentials and session cookies are high-value targets that grant attackers immediate authenticated access to corporate and personal accounts. The attack chain highlights how social engineering (disguising malware as useful software) combined with technical evasion can bypass even modern browser security mechanisms. Organizations relying solely on endpoint detection without behavioral monitoring or user training are especially vulnerable.",[142,143,144,145,146,147,148],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32",{"GDPR Article 32":150,"MITRE ATT&CK T1566: Phishing":151,"NIST SP 800-53 SI-2: Flaw Remediation":152,"CIS Control 7: Continuous Vulnerability Management":153,"CIS Control 14: Security Awareness and Skills Training":154,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"If the stolen browser credentials or cookies include access to systems processing personal data, the exfiltration constitutes a personal data breach; Article 32 requires organizations to implement appropriate technical measures — such as MFA and endpoint controls — to prevent exactly this type of unauthorized access.","Abe Office relies on social engineering — disguising itself as a legitimate office helper tool — which mirrors the phishing tactic of deceiving users into executing malicious payloads; awareness and controls against this vector directly address the initial infection method.","The bypass technique targets a specific implementation weakness in Chrome's encryption service; a formal flaw remediation process ensures browser and OS components are patched promptly before attackers can operationalize such weaknesses.","The malware exploits a known weakness in Chrome's App-Bound Encryption elevation service; continuous vulnerability scanning and prompt patching of browsers and security components would reduce the attack surface available to this technique.","Users who installed this malware were deceived by its legitimate appearance; structured training on recognizing fake productivity tools and the risks of unofficial software downloads would reduce the likelihood of initial execution.","The malware exploits a technical weakness in browser encryption mechanisms; a vulnerability management process covering third-party applications like Chrome would ensure timely mitigation of known bypass techniques.","Stolen cookies and passwords directly undermine authentication integrity; enforcing phishing-resistant MFA ensures that even successfully exfiltrated credentials cannot be used to gain unauthorized access to systems."]