Cloud vn105rkj64 — Italian Invoice Phishing Drops Windows Backdoor and Force-Installed Chrome Extension Abusing Native Messaging for Cookie Theft, MFA Bypass, and Remote PowerShell

Key facts for Cloud vn105rkj64 Chrome backdoor

Detection coverage for Cloud vn105rkj64 Chrome backdoor

As of 2026-06-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0948 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Native-Messaging Backdoor C2 Beacon and Session-Cookie Exfil to ext2.info — C2 / Remote Command

Detects the command-and-control and exfiltration stage: outbound HTTPS to the C2 domain ext2.info (2.27.5.53) / cd-nwlins.site, especially the POST endpoint time.php?q=ste_jstest2 carrying the stolen Google session cookie, tabs, UA and victim ID. Also surfaces the native-messaging backdoor executing interactive PowerShell (e.g. directory listing of C:\) outside the Chrome sandbox.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1041, T1539, T1059.001, T1083
• Data sources: proxy, zeek, sysmon, microsoft_defender_for_endpoint, dns
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR index=network OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=3 OR EventCode=22)
| eval dst=lower(coalesce(QueryName,DestinationHostname,url,dest_host)), u=lower(coalesce(url,uri_path,uri))
| where like(dst,"%ext2.info%") OR like(dst,"%cd-nwlins.site%") OR DestinationIp="2.27.5.53" OR like(u,"%time.php?q=ste_jstest2%")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(dst) as c2 values(u) as uri values(Image) as process by host User src
| convert ctime(firstSeen) ctime(lastSeen)
| `comment("ext2.info native-messaging backdoor C2/exfil — TL-2026-0948 command-and-control")`

Microsoft KQL

let c2domains = dynamic(["ext2.info", "cd-nwlins.site"]);
union
(
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (c2domains) or RemoteIP == "2.27.5.53" or RemoteUrl has "time.php?q=ste_jstest2"
    | project Timestamp, DeviceName, ActionType, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
),
(
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "powershell.exe"
    | where InitiatingProcessFileName !in~ ("explorer.exe", "cmd.exe")
    | where ProcessCommandLine has_any ("dir C:\\", "Get-ChildItem C:\\", "gci C:\\")
    | where InitiatingProcessCommandLine has_any ("NativeMessaging", "com.vn105rkj64") or InitiatingProcessParentFileName =~ "chrome.exe"
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| order by Timestamp desc

Sigma

title: ext2.info Native-Messaging Backdoor C2 Beacon and Session-Cookie Exfiltration
id: 6f1a2c34-0a48-4d11-9c01-0948aa000003
status: experimental
description: Detects outbound C2/exfiltration to the Cloud vn105rkj64 infrastructure ext2.info (2.27.5.53) / cd-nwlins.site, including the time.php?q=ste_jstest2 exfil endpoint that ships stolen Google session cookies for MFA-bypassing account takeover (TL-2026-0948).
references:
    - https://www.malwarebytes.com/blog/news/2026/06/malware-steals-chrome-session-cookies-to-take-over-your-accounts
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-26
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.credential_access
    - attack.execution
    - attack.t1071.001
    - attack.t1041
    - attack.t1539
    - attack.t1059.001
logsource:
    category: dns
    product: windows
detection:
    selection_domain:
        QueryName|contains:
            - 'ext2.info'
            - 'cd-nwlins.site'
    selection_url:
        QueryName|contains: 'time.php?q=ste_jstest2'
    condition: selection_domain or selection_url
falsepositives:
    - Security researchers or sandboxes intentionally resolving the C2 domain for analysis
level: critical

Known false positives:

• Threat-intel sandboxes or analysts deliberately contacting the C2 domain
• DNS sinkhole responses that still log the original query

Tuning notes: Promote the domain/IP IOCs (ext2.info, cd-nwlins.site, 2.27.5.53) into your threat-intel match framework for retro-hunting. Tune the PowerShell branch to your environment's native-messaging broker process name; a chrome.exe-rooted process tree spawning powershell.exe that enumerates C:\ is the strongest signal of the backdoor.

• 🔒 Signed Epic Games Launcher Side-Loads Malicious [indicator] from %TEMP% — Exploitation · unlock with TL Creds
• 🔒 Rogue Chrome Extension Force-Install and Native Messaging Host Persistence — Post-Exploitation · unlock with TL Creds
• 🔒 Native Messaging Host Spawns PowerShell and Enumerates C:\ — Browser Sandbox Escape / Remote Command · unlock with TL Creds
• 🔒 Invoice-Themed Script Dropper Chain: wscript to Signed Launcher to Hidden PowerShell — Exploitation · unlock with TL Creds
• 🔒 Chrome Policy Allowlist + Native Messaging Host Registration (Cloud vn105rkj64) — Post-Exploitation · unlock with TL Creds
• 🔒 Native Messaging Backdoor C2 to [indicator] with Session-Cookie Exfiltration — C2 / Exfiltration · unlock with TL Creds
• 🔒 Double-Extension .pfd.js Dropper Executed by Windows Script Host — Exploitation · unlock with TL Creds
• 🔒 Chrome Enterprise Policy Force-Install + Native Messaging Host Registration via HKCU — Post-Exploitation · unlock with TL Creds

Indicators of compromise for Cloud vn105rkj64 Chrome backdoor

As of 2026-06-26, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-0948.

Sample indicators (3 of 22)

• IP address: 2.27.5[.]53
• Domain: ext2[.]info
• File hash: 61f07213f2e54c54ec379714fd211c73

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

How Cloud vn105rkj64 Chrome backdoor works

In June 2026, Italian security firm D3Lab — with reporting amplified by Malwarebytes, Cyber Security News and GBHackers — documented a malware campaign that turns Google Chrome into a remote-command backdoor without breaking any of the browser's built-in security rules. The intrusion begins with Italian-language phishing emails impersonating accounting/invoice notifications (e.g. subject 'Fattura #2818999851'), carrying an attachment displayed as a PDF ('Fattura-26189991026.pdf') that is actually an obfuscated JavaScript file named 'Fattura-2819889242.pfd.js' — the transposed '.pfd.js' extension is engineered to read as '.pdf' at a glance.

When the victim opens the lure, Windows Script Host (wscript.exe) executes the obfuscated JavaScript, which decodes and writes two files to the user's temporary folder: 'client_124578.exe', a legitimately digitally-signed Epic Games launcher binary, and 'd3d11.dll', the attacker's malicious library. Launching the trusted signed executable triggers DLL search-order side-loading: the Epic Games binary loads the attacker-controlled d3d11.dll instead of the genuine system DLL, executing malicious code under the cover of a signed, reputable process. The DLL spawns a hidden PowerShell process that performs the browser-hijack stage.

PowerShell tampers with Chrome enterprise policy registry keys under HKCU\Software\Policies\Google\Chrome — writing the malicious extension into ExtensionInstallAllowlist and pointing ExtensionInstallSources at a local source (observed value http://localhost:8080/*) — so the rogue extension 'Cloud vn105rkj64' (ID gghagmhimhgfeajfdmjkgmmehbokmglg, manifest v2) appears to Chrome as an administrator-approved, policy-deployed extension and installs without user interaction. PowerShell also registers a Native Messaging Host named com.vn105rkj64.tr7qprrt7g under HKCU\Software\Google\Chrome\NativeMessagingHosts, whose manifest points to a locally stored native executable.

Native Messaging is the legitimate Chrome mechanism that lets an extension exchange length-prefixed JSON messages with a native host over stdio. Here it is weaponized as a browser-to-OS bridge: the in-sandbox extension issues commands that the native host runs entirely outside Chrome's sandbox. On activation the extension's first exchange exfiltrates a Google session cookie, the list of open tabs and URLs, the browser user-agent and language settings, and a stable victim identifier to the C2. Stolen authenticated session cookies allow the operators to replay an already-authenticated session and take over accounts WITHOUT the password and WITHOUT triggering multi-factor authentication, since the session is already past the MFA challenge. Beyond theft, the controller demonstrated interactive remote control — issuing instructions that returned a directory listing of C:\ and executing arbitrary PowerShell — making the extension/native-host pairing a full remote-access backdoor rather than a simple infostealer.

The extension communicates with its C2 at ext2[.]info (resolving to 2.27.5.53) over HTTPS, using POST requests such as POST https://ext2[.]info/time.php?q=ste_jstest2 for command delivery and data exfiltration; a related domain cd-nwlins[.]site returned parked content during analysis. The campaign is geographically focused on Italian-speaking victims via localized invoice lures. No specific named threat actor has been publicly attributed. Defensive coverage exists: Malwarebytes Browser Guard blocks the ext2[.]info domain, and the documented registry, native-messaging and DLL-sideloading artifacts provide strong host-based detection opportunities.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1185 Browser Session Hijacking

Defense Evasion

T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1574 Hijack Execution Flow

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

defense-impairment

T1112 Modify Registry

Persistence

T1176 Software Extensions

Credential Access

T1539 Steal Web Session Cookie

Initial Access

T1566 Phishing

stealth

T1574 Hijack Execution Flow

Remediation for Cloud vn105rkj64 Chrome backdoor

Immediate actions

• Block C2 domain ext2[.]info and IP 2.27.5.53 (and cd-nwlins[.]site) at the web proxy, DNS and firewall.
• Hunt for and remove the Chrome extension ID gghagmhimhgfeajfdmjkgmmehbokmglg ('Cloud vn105rkj64') across the fleet.
• Delete attacker-written Chrome policy values under HKCU\Software\Policies\Google\Chrome (ExtensionInstallAllowlist, ExtensionInstallSources) and the Native Messaging Host key HKCU\Software\Google\Chrome\NativeMessagingHosts\com.vn105rkj64.tr7qprrt7g.
• Force-revoke and rotate all session cookies / re-authenticate users on potentially compromised machines; invalidate Google and SSO sessions server-side to defeat stolen-cookie replay.
• Quarantine the dropper artifacts client_124578.exe and d3d11.dll and scan %TEMP% on affected hosts.

Workarounds

• Block execution of .pfd.js / double-extension script attachments at the email gateway.
• Monitor and alert on writes to Chrome policy registry keys under HKCU and on new NativeMessagingHosts entries.

Longer-term hardening

• Enforce Chrome extension governance via legitimate, centrally-managed ExtensionInstallForcelist/ExtensionInstallBlocklist policy (cloud-managed, not HKCU) and ExtensionSettings to allowlist only approved extensions.
• Deploy EDR with behavioral detection for DLL side-loading, wscript.exe spawning, and unexpected Native Messaging Host registrations.
• Restrict or disable Windows Script Host (wscript.exe/cscript.exe) execution of .js attachments and block script-host execution from mail/temp paths.
• Adopt token-binding / device-bound session credentials (e.g. DBSC) and short cookie lifetimes to reduce the value of stolen session cookies.
• User awareness training on double-extension lures and Italian invoice-themed phishing.

Affected and fixed versions

• Google — Chrome
  Vulnerable versions: Manifest V2 extensions on Windows endpoints with user-writable HKCU Chrome policy keys
• Microsoft — Windows
  Vulnerable versions: Windows endpoints with Windows Script Host enabled
• Epic Games — Epic Games Launcher (client_124578.exe, abused for DLL side-loading)
  Vulnerable versions: signed launcher binary susceptible to d3d11.dll search-order hijack

Timeline of Cloud vn105rkj64 Chrome backdoor

• 2026-06-25 Controller issues interactive commands; native host executes PowerShell and returns a directory listing of C:\, confirming a full remote-access backdoor.
• 2026-06-25 Extension's first C2 exchange exfiltrates a Google session cookie, open tabs/URLs, user-agent, language settings and a victim identifier to locked-ioc-21 (locked-ioc-22) via POST locked-ioc-11.
• 2026-06-25 Native Messaging Host locked-ioc-15 is registered under HKCU\Software\Google\Chrome\NativeMessagingHosts, bridging the extension to native code outside the sandbox.
• 2026-06-25 PowerShell modifies Chrome policy registry keys (ExtensionInstallAllowlist, ExtensionInstallSources=http://localhost:8080/*) to force-install extension 'locked-ioc-18' (locked-ioc-13) as admin-approved.
• 2026-06-25 The signed Epic Games executable side-loads the malicious locked-ioc-20 via search-order hijack, which spawns a hidden PowerShell process.
• 2026-06-25 Victim opens the lure; Windows Script Host executes obfuscated JavaScript that decodes and drops 'locked-ioc-17' (signed Epic Games launcher) and 'locked-ioc-20' to %TEMP%.
• 2026-06-25 Italian-language invoice phishing emails (e.g. subject 'Fattura #2818999851') deliver an attachment displayed as 'locked-ioc-16' that is actually the JavaScript dropper 'locked-ioc-14'.
• 2026-06-26 D3Lab analysis is published and amplified by Malwarebytes, Cyber Security News and GBHackers; Malwarebytes Browser Guard blocks locked-ioc-21.

Sources cited for Cloud vn105rkj64 Chrome backdoor

• Malicious Chrome Extension Uses Native Messaging Host to Execute PowerShell Commands cybersecuritynews.com · Research · 2026-06-25
• Hackers Use Malicious Chrome Extension to Break Out of Browser Sandbox gbhackers.com · Research · 2026-06-25
• Chrome Native Messaging — developer documentation (mechanism abused) developer.chrome.com · Vendor report · 2026-06-26
• Malware steals Chrome session cookies to take over your accounts malwarebytes.com · Blog · 2026-06-26
• Hackers Abuse Chrome Policy Keys to Force-Install Malicious Browser Extension cyberpress.org · News · 2026-06-25
• New Malware Campaign Hijacks Chrome by Mimicking Administrative Policy Keys the420.in · News · 2026-06-25
• Malicious Chrome Extension Uses Native Messaging Host to Execute PowerShell Commands (mirror) cryptika.com · News · 2026-06-25

Threats related to Cloud vn105rkj64 Chrome backdoor

• EKZ Infostealer Campaign — FortiClient EMS CVE-2026-35616 Abused via on_connect Script Injection (Arctic Wolf, May 2026)
• Nimbus RAT (BackupBOX) — Microsoft Teams Vishing + Quick Assist Delivery of a Self-Contained Java RAT Using Google Drive/Sheets for C2 (BlackSuit Affiliate)
• The Quarry PhaaS/MaaS Operation Impersonating IRS and SSA to Deliver ConnectWise ScreenConnect RMM Access
• Fake AI Tool Attacks on SMBs: 33,300 Cyberattacks Masquerading as ChatGPT, Copilot, Claude in Early 2026

Previous and next in malware

• TonRAT Node.js Implant Campaign — Photo-Themed ZIP/.LNK Lures Target Hospitality Sector for Persistent Access (Waves 1 & 2) Previous report
• Operation DragonReturn — China-Nexus DcRAT Multi-Stage Espionage Campaign Targeting Govt. of India Ministry of Finance / Income Tax Infrastructure Next report