Cloud vn105rkj64 — Italian Invoice Phishing Drops Windows Backdoor and Force-Installed Chrome Extension Abusing Native Messaging for Cookie Theft, MFA Bypass, and Remote PowerShell
Cloud vn105rkj64 (TL-2026-0948), also tracked as Cloud vn105rkj64 extension backdoor, is a high-severity malware campaign, first published 2026-06-26. It has no confirmed attribution, affects Google Chrome, maps to 18 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-0948
- Threat ID
- TL-2026-0948
- Also known as
- Cloud vn105rkj64 extension backdoor, ext2.info Chrome Native Messaging backdoor
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-26
- Last reviewed
- 2026-06-26
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- finance, accounting, small-and-medium-business, enterprise
- Target regions
- Italy, Europe
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Cloud vn105rkj64
Malware and tooling: Cloud vn105rkj64
An Italian-language invoice phishing campaign delivers a .pfd.js JavaScript dropper that side-loads a malicious d3d11.dll via a signed Epic Games executable and force-installs a Chrome extension ('Cloud vn105rkj64', ID gghagmhimhgfeajfdmjkgmmehbokmglg) by tampering with Chrome enterprise policy registry keys. The extension registers a Native Messaging Host (com.vn105rkj64.tr7qprrt7g) to escape the browser sandbox, exfiltrating Google session cookies, tabs, URLs and fingerprinting data to ext2[.]info for account takeover and MFA bypass, while functioning as an interactive remote PowerShell backdoor.
How Cloud vn105rkj64 works
In June 2026, Italian security firm D3Lab — with reporting amplified by Malwarebytes, Cyber Security News and GBHackers — documented a malware campaign that turns Google Chrome into a remote-command backdoor without breaking any of the browser's built-in security rules. The intrusion begins with Italian-language phishing emails impersonating accounting/invoice notifications (e.g. subject 'Fattura #2818999851'), carrying an attachment displayed as a PDF ('Fattura-26189991026.pdf') that is actually an obfuscated JavaScript file named 'Fattura-2819889242.pfd.js' — the transposed '.pfd.js' extension is engineered to read as '.pdf' at a glance.
When the victim opens the lure, Windows Script Host (wscript.exe) executes the obfuscated JavaScript, which decodes and writes two files to the user's temporary folder: 'client_124578.exe', a legitimately digitally-signed Epic Games launcher binary, and 'd3d11.dll', the attacker's malicious library. Launching the trusted signed executable triggers DLL search-order side-loading: the Epic Games binary loads the attacker-controlled d3d11.dll instead of the genuine system DLL, executing malicious code under the cover of a signed, reputable process. The DLL spawns a hidden PowerShell process that performs the browser-hijack stage.
PowerShell tampers with Chrome enterprise policy registry keys under HKCU\Software\Policies\Google\Chrome — writing the malicious extension into ExtensionInstallAllowlist and pointing ExtensionInstallSources at a local source (observed value http://localhost:8080/*) — so the rogue extension 'Cloud vn105rkj64' (ID gghagmhimhgfeajfdmjkgmmehbokmglg, manifest v2) appears to Chrome as an administrator-approved, policy-deployed extension and installs without user interaction. PowerShell also registers a Native Messaging Host named com.vn105rkj64.tr7qprrt7g under HKCU\Software\Google\Chrome\NativeMessagingHosts, whose manifest points to a locally stored native executable.
Native Messaging is the legitimate Chrome mechanism that lets an extension exchange length-prefixed JSON messages with a native host over stdio. Here it is weaponized as a browser-to-OS bridge: the in-sandbox extension issues commands that the native host runs entirely outside Chrome's sandbox. On activation the extension's first exchange exfiltrates a Google session cookie, the list of open tabs and URLs, the browser user-agent and language settings, and a stable victim identifier to the C2. Stolen authenticated session cookies allow the operators to replay an already-authenticated session and take over accounts WITHOUT the password and WITHOUT triggering multi-factor authentication, since the session is already past the MFA challenge. Beyond theft, the controller demonstrated interactive remote control — issuing instructions that returned a directory listing of C:\ and executing arbitrary PowerShell — making the extension/native-host pairing a full remote-access backdoor rather than a simple infostealer.
The extension communicates with its C2 at ext2[.]info (resolving to 2.27.5.53) over HTTPS, using POST requests such as POST https://ext2[.]info/time.php?q=ste_jstest2 for command delivery and data exfiltration; a related domain cd-nwlins[.]site returned parked content during analysis. The campaign is geographically focused on Italian-speaking victims via localized invoice lures. No specific named threat actor has been publicly attributed. Defensive coverage exists: Malwarebytes Browser Guard blocks the ext2[.]info domain, and the documented registry, native-messaging and DLL-sideloading artifacts provide strong host-based detection opportunities.
MITRE ATT&CK techniques used in TL-2026-0948
Collection
T1005 Data from Local System; T1185 Browser Session Hijacking
Defense Evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1574 Hijack Execution Flow
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
defense-impairment
Persistence
Credential Access
T1539 Steal Web Session Cookie
Initial Access
stealth
Affected products and versions in Cloud vn105rkj64
- Google — Chrome
Vulnerable versions: Manifest V2 extensions on Windows endpoints with user-writable HKCU Chrome policy keys - Microsoft — Windows
Vulnerable versions: Windows endpoints with Windows Script Host enabled - Epic Games — Epic Games Launcher (client_124578.exe, abused for DLL side-loading)
Vulnerable versions: signed launcher binary susceptible to d3d11.dll search-order hijack
Remediation for Cloud vn105rkj64
Immediate actions
- Block C2 domain ext2[.]info and IP 2.27.5.53 (and cd-nwlins[.]site) at the web proxy, DNS and firewall.
- Hunt for and remove the Chrome extension ID gghagmhimhgfeajfdmjkgmmehbokmglg ('Cloud vn105rkj64') across the fleet.
- Delete attacker-written Chrome policy values under HKCU\Software\Policies\Google\Chrome (ExtensionInstallAllowlist, ExtensionInstallSources) and the Native Messaging Host key HKCU\Software\Google\Chrome\NativeMessagingHosts\com.vn105rkj64.tr7qprrt7g.
- Force-revoke and rotate all session cookies / re-authenticate users on potentially compromised machines; invalidate Google and SSO sessions server-side to defeat stolen-cookie replay.
- Quarantine the dropper artifacts client_124578.exe and d3d11.dll and scan %TEMP% on affected hosts.
Workarounds
- Block execution of .pfd.js / double-extension script attachments at the email gateway.
- Monitor and alert on writes to Chrome policy registry keys under HKCU and on new NativeMessagingHosts entries.
Longer-term hardening
- Enforce Chrome extension governance via legitimate, centrally-managed ExtensionInstallForcelist/ExtensionInstallBlocklist policy (cloud-managed, not HKCU) and ExtensionSettings to allowlist only approved extensions.
- Deploy EDR with behavioral detection for DLL side-loading, wscript.exe spawning, and unexpected Native Messaging Host registrations.
- Restrict or disable Windows Script Host (wscript.exe/cscript.exe) execution of .js attachments and block script-host execution from mail/temp paths.
- Adopt token-binding / device-bound session credentials (e.g. DBSC) and short cookie lifetimes to reduce the value of stolen session cookies.
- User awareness training on double-extension lures and Italian invoice-themed phishing.
Weaknesses (CWE) in Cloud vn105rkj64
CWE-427, CWE-426, CWE-829, CWE-522, CWE-384, CWE-668
Timeline of Cloud vn105rkj64
- Controller issues interactive commands; native host executes PowerShell and returns a directory listing of C:\, confirming a full remote-access backdoor.
- Extension's first C2 exchange exfiltrates a Google session cookie, open tabs/URLs, user-agent, language settings and a victim identifier to ext2[.]info (2.27.5.53) via POST https://ext2[.]info/time.php?q=ste_jstest2.
- Native Messaging Host com.vn105rkj64.tr7qprrt7g is registered under HKCU\Software\Google\Chrome\NativeMessagingHosts, bridging the extension to native code outside the sandbox.
- PowerShell modifies Chrome policy registry keys (ExtensionInstallAllowlist, ExtensionInstallSources=http://localhost:8080/*) to force-install extension 'Cloud vn105rkj64' (gghagmhimhgfeajfdmjkgmmehbokmglg) as admin-approved.
- The signed Epic Games executable side-loads the malicious d3d11.dll via search-order hijack, which spawns a hidden PowerShell process.
- Victim opens the lure; Windows Script Host executes obfuscated JavaScript that decodes and drops 'client_124578.exe' (signed Epic Games launcher) and 'd3d11.dll' to %TEMP%.
- Italian-language invoice phishing emails (e.g. subject 'Fattura #2818999851') deliver an attachment displayed as 'Fattura-26189991026.pdf' that is actually the JavaScript dropper 'Fattura-2819889242.pfd.js'.
- D3Lab analysis is published and amplified by Malwarebytes, Cyber Security News and GBHackers; Malwarebytes Browser Guard blocks ext2[.]info.
Sources cited for Cloud vn105rkj64
- Malware steals Chrome session cookies to take over your accounts
- Malicious Chrome Extension Uses Native Messaging Host to Execute PowerShell Commands
- Hackers Use Malicious Chrome Extension to Break Out of Browser Sandbox
- Hackers Abuse Chrome Policy Keys to Force-Install Malicious Browser Extension
- New Malware Campaign Hijacks Chrome by Mimicking Administrative Policy Keys
- Malicious Chrome Extension Uses Native Messaging Host to Execute PowerShell Commands (mirror)
- Chrome Native Messaging — developer documentation (mechanism abused)
Threats related to Cloud vn105rkj64
- EKZ Infostealer Campaign — FortiClient EMS CVE-2026-35616 Abused via on_connect Script Injection (Arctic Wolf, May 2026)
- Nimbus RAT (BackupBOX) — Microsoft Teams Vishing + Quick Assist Delivery of a Self-Contained Java RAT Using Google Drive/Sheets for C2 (BlackSuit Affiliate)
- The Quarry PhaaS/MaaS Operation Impersonating IRS and SSA to Deliver ConnectWise ScreenConnect RMM Access
- Fake AI Tool Attacks on SMBs: 33,300 Cyberattacks Masquerading as ChatGPT, Copilot, Claude in Early 2026
Detection coverage for TL-2026-0948
As of 2026-06-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0948 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.