Abe Office RAT bypasses Chrome App-Bound Encryption to steal passwords
Original title: New Abe Office Malware Bypasses Chrome App-Bound Encryption to Steal Browser Passwords and Cookies
The signed AbeAgent.exe uses a default password, injects a helper into off-screen Chrome, and was seen operating in a sandbox.
Rogue Authority analyzed Abe Office, a remote-access trojan posing as an office helper and signed with a personal SSL.com certificate. It persists via a Run key and scheduled task, decrypts bundled add-ons with a hardcoded password, and injects a helper into off-screen Chrome and Edge so App-Bound Encryption releases keys. In a sandbox the operator opened hidden browsers and saved-password pages; delivery is unknown.
Unconfirmed: Delivery method is unknown, and the sandbox held no saved passwords so theft there was not observed.
- Certificate for Kimberley Hankinson became valid on October 26 and the file was signed on November 4.
- Default password AbeOffice-ChangeMe derives the AES key used for add-ons and traffic.
- Command servers are 2.26.230.54 and 87.199.195.141; VirusTotal links 133 files to them.
- Operator connected three times over about a day and a half; the sandbox held no saved passwords.
Impact: browser passwords, cookies, and live signed-in sessions
| Product | Affected |
|---|---|
| Google Chrome | App-Bound Encryption from Chrome 127 |
| Microsoft Edge | — |
- 1.Sign out of sessions, change key passwords, and enable two-factor authentication from a clean device.
- 2.Look for AbeOffice folders, the Abe Office Sync Run value, and processes started with –autostart.
- 3.Block outbound traffic to both servers on port 9090.
- ATT&CK
- T1555.003 Credentials from Web BrowsersT1055 Process InjectionT1547.001 Registry Run Keys / Startup FolderT1053.005 Scheduled Task
- Malware
- Abe OfficeAbeAgent.exe
- Organizations
- Rogue Authority
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 2.26.230.54 | rt shows the same DLL injection idea. The command server at 2.26.230[.]54 also hosts the operator’s control panel. Shodan data show |
| ipv4 | 87.199.195.141 | “Abe Update” page listing the kit’s files. A second server, 87.199.195[.]141, served the same page. VirusTotal links 133 files to the |
From the original article
4 min read at cybersecuritynews.com
A new remote-access trojan called Abe Office can steal browser passwords and cookies, even from Chrome’s App-Bound Encryption. It poses as an office helper tool and carries a valid code-signing certificate. Researchers at Rogue Authority broke its weak protections and watched the operator at work in a sandbox.
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.