Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehighExploited in the wild

Abe Office malware bypasses Chrome App-Bound Encryption for cookies

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Signed Abe Office malware injects helpers into off-screen Chrome and Edge to decrypt App-Bound cookies and steal browser data.

Abe Office, delivered as AbeAgent.exe and posing as an office helper, is a remote-access trojan that bypasses Chrome App-Bound Encryption to steal passwords and cookies. Cyber Security News, citing Rogue Authority, says it is signed with a personal SSL.com certificate for Kimberley Hankinson, persists via a Run key and scheduled task, and decrypts add-ons with the password AbeOffice-ChangeMe. It injects a helper into off-screen Chrome and Edge so the elevation service releases keys. GBHackers also names Brave, Opera, and Firefox and reports no stealer execution in a sandbox, while Cyber Security News says an operator connected three times over roughly a day and a half and opened hidden browsers. Delivery is unknown, and command servers are 2.26.230.54, listed by GBHackers on port 9090, and 87.199.195.141.

Key facts
  • SSL.com certificate for Kimberley Hankinson; the file was signed on November 4.
  • That certificate became valid on October 26, Cyber Security News reports.
  • Password AbeOffice-ChangeMe derives the AES key for add-ons and traffic.
  • Persists with a Run key and scheduled task; how it is delivered is unknown.
  • Servers 2.26.230.54 port 9090 and 87.199.195.141; VirusTotal links 133 files.
  • GBHackers lists Chrome, Edge, Brave, Opera, and Firefox as theft targets.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 26, 2026SSL.com certificate for Kimberley Hankinson became valid · Cyber Security News
  2. Nov 4, 2026AbeAgent.exe was signed with that certificate · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersNames Brave, Opera, and Firefox, port 9090, and no sandbox stealer run.
  • Cyber Security NewsAdds second server, 133 VirusTotal files, signing dates, and operator sessions.
Vendors
GoogleMicrosoftSSL.com
Products
ChromeEdge
Malware
AbeOffice RATAbe OfficeAbeAgent.exe
Organizations
Rogue Authority

Coverage

oldest first · one row per article · UTC
  1. · 2d ago GBHackersFirst report

    Abe Office Malware Injects Into Chrome To Decrypt App-Bound Cookies

    The RAT uses browser injection to bypass Chrome's App-Bound Encryption for cookie decryption.

  2. · 2d ago Cyber Security News

    Abe Office RAT bypasses Chrome App-Bound Encryption to steal passwords

    The signed AbeAgent.exe uses a default password, injects a helper into off-screen Chrome, and was seen operating in a sandbox.