# Cloud vn105rkj64 — Italian Invoice Phishing Drops Windows Backdoor and Force-Installed Chrome Extension Abusing Native Messaging for Cookie Theft, MFA Bypass, and Remote PowerShell

> An Italian-language invoice phishing campaign delivers a .pfd.js JavaScript dropper that side-loads a malicious d3d11.dll via a signed Epic Games executable and force-installs a Chrome extension ('Cloud vn105rkj64', ID gghagmhimhgfeajfdmjkgmmehbokmglg) by tampering with Chrome enterprise policy registry keys. The extension registers a Native Messaging Host (com.vn105rkj64.tr7qprrt7g) to escape the browser sandbox, exfiltrating Google session cookies, tabs, URLs and fingerprinting data to ext2[.]info for account takeover and MFA bypass, while functioning as an interactive remote PowerShell backdoor.

- **Published:** 2026-06-26T00:00:00Z
- **Last reviewed:** 2026-06-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0948
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-cloud-vn105rkj64-chrome-backdoor-tl-2026-0948.webp?v=5ab17eeb (Threadlinqs threat intel: Cloud vn105rkj64 Chrome Backdoor: Detection & IOCs (TL-2026-0948) — High severity, 22 IOCs, 9 detection rules.)
- **ID:** TL-2026-0948
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

In June 2026, Italian security firm D3Lab — with reporting amplified by Malwarebytes, Cyber Security News and GBHackers — documented a malware campaign that turns Google Chrome into a remote-command backdoor without breaking any of the browser's built-in security rules. The intrusion begins with Italian-language phishing emails impersonating accounting/invoice notifications (e.g. subject 'Fattura #2818999851'), carrying an attachment displayed as a PDF ('Fattura-26189991026.pdf') that is actually an obfuscated JavaScript file named 'Fattura-2819889242.pfd.js' — the transposed '.pfd.js' extension is engineered to read as '.pdf' at a glance.

When the victim opens the lure, Windows Script Host (wscript.exe) executes the obfuscated JavaScript, which decodes and writes two files to the user's temporary folder: 'client_124578.exe', a legitimately digitally-signed Epic Games launcher binary, and 'd3d11.dll', the attacker's malicious library. Launching the trusted signed executable triggers DLL search-order side-loading: the Epic Games binary loads the attacker-controlled d3d11.dll instead of the genuine system DLL, executing malicious code under the cover of a signed, reputable process. The DLL spawns a hidden PowerShell process that performs the browser-hijack stage.

PowerShell tampers with Chrome enterprise policy registry keys under HKCU\Software\Policies\Google\Chrome — writing the malicious extension into ExtensionInstallAllowlist and pointing ExtensionInstallSources at a local source (observed value http://localhost:8080/*) — so the rogue extension 'Cloud vn105rkj64' (ID gghagmhimhgfeajfdmjkgmmehbokmglg, manifest v2) appears to Chrome as an administrator-approved, policy-deployed extension and installs without user interaction. PowerShell also registers a Native Messaging Host named com.vn105rkj64.tr7qprrt7g under HKCU\Software\Google\Chrome\NativeMessagingHosts, whose manifest points to a locally stored native executable.

Native Messaging is the legitimate Chrome mechanism that lets an extension exchange length-prefixed JSON messages with a native host over stdio. Here it is weaponized as a browser-to-OS bridge: the in-sandbox extension issues commands that the native host runs entirely outside Chrome's sandbox. On activation the extension's first exchange exfiltrates a Google session cookie, the list of open tabs and URLs, the browser user-agent and language settings, and a stable victim identifier to the C2. Stolen authenticated session cookies allow the operators to replay an already-authenticated session and take over accounts WITHOUT the password and WITHOUT triggering multi-factor authentication, since the session is already past the MFA challenge. Beyond theft, the controller demonstrated interactive remote control — issuing instructions that returned a directory listing of C:\ and executing arbitrary PowerShell — making the extension/native-host pairing a full remote-access backdoor rather than a simple infostealer.

The extension communicates with its C2 at ext2[.]info (resolving to 2.27.5.53) over HTTPS, using POST requests such as POST https://ext2[.]info/time.php?q=ste_jstest2 for command delivery and data exfiltration; a related domain cd-nwlins[.]site returned parked content during analysis. The campaign is geographically focused on Italian-speaking victims via localized invoice lures. No specific named threat actor has been publicly attributed. Defensive coverage exists: Malwarebytes Browser Guard blocks the ext2[.]info domain, and the documented registry, native-messaging and DLL-sideloading artifacts provide strong host-based detection opportunities.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1559 Inter-Process Communication
- T1176 Software Extensions
- T1574 Hijack Execution Flow
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1112 Modify Registry
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1539 Steal Web Session Cookie
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1185 Browser Session Hijacking
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Native-Messaging Backdoor C2 Beacon and Session-Cookie Exfil to ext2.info — C2 / Remote Command** (`TL-2026-0948-SPL-003`)

Detects the command-and-control and exfiltration stage: outbound HTTPS to the C2 domain ext2.info (2.27.5.53) / cd-nwlins.site, especially the POST endpoint time.php?q=ste_jstest2 carrying the stolen Google session cookie, tabs, UA and victim ID. Also surfaces the native-messaging backdoor executing interactive PowerShell (e.g. directory listing of C:\) outside the Chrome sandbox.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1041, T1539, T1059.001, T1083
- **Data sources:** proxy, zeek, sysmon, microsoft_defender_for_endpoint, dns
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy OR index=network OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=3 OR EventCode=22)
| eval dst=lower(coalesce(QueryName,DestinationHostname,url,dest_host)), u=lower(coalesce(url,uri_path,uri))
| where like(dst,"%ext2.info%") OR like(dst,"%cd-nwlins.site%") OR DestinationIp="2.27.5.53" OR like(u,"%time.php?q=ste_jstest2%")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(dst) as c2 values(u) as uri values(Image) as process by host User src
| convert ctime(firstSeen) ctime(lastSeen)
| `comment("ext2.info native-messaging backdoor C2/exfil — TL-2026-0948 command-and-control")`
```

### Microsoft KQL

```kql
let c2domains = dynamic(["ext2.info", "cd-nwlins.site"]);
union
(
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any (c2domains) or RemoteIP == "2.27.5.53" or RemoteUrl has "time.php?q=ste_jstest2"
    | project Timestamp, DeviceName, ActionType, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
),
(
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "powershell.exe"
    | where InitiatingProcessFileName !in~ ("explorer.exe", "cmd.exe")
    | where ProcessCommandLine has_any ("dir C:\\", "Get-ChildItem C:\\", "gci C:\\")
    | where InitiatingProcessCommandLine has_any ("NativeMessaging", "com.vn105rkj64") or InitiatingProcessParentFileName =~ "chrome.exe"
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
)
| order by Timestamp desc
```

### Sigma

```yaml
title: ext2.info Native-Messaging Backdoor C2 Beacon and Session-Cookie Exfiltration
id: 6f1a2c34-0a48-4d11-9c01-0948aa000003
status: experimental
description: Detects outbound C2/exfiltration to the Cloud vn105rkj64 infrastructure ext2.info (2.27.5.53) / cd-nwlins.site, including the time.php?q=ste_jstest2 exfil endpoint that ships stolen Google session cookies for MFA-bypassing account takeover (TL-2026-0948).
references:
    - https://www.malwarebytes.com/blog/news/2026/06/malware-steals-chrome-session-cookies-to-take-over-your-accounts
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-26
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.credential_access
    - attack.execution
    - attack.t1071.001
    - attack.t1041
    - attack.t1539
    - attack.t1059.001
logsource:
    category: dns
    product: windows
detection:
    selection_domain:
        QueryName|contains:
            - 'ext2.info'
            - 'cd-nwlins.site'
    selection_url:
        QueryName|contains: 'time.php?q=ste_jstest2'
    condition: selection_domain or selection_url
falsepositives:
    - Security researchers or sandboxes intentionally resolving the C2 domain for analysis
level: critical
```

**Known false positives:**

- Threat-intel sandboxes or analysts deliberately contacting the C2 domain
- DNS sinkhole responses that still log the original query

**Tuning notes:** Promote the domain/IP IOCs (ext2.info, cd-nwlins.site, 2.27.5.53) into your threat-intel match framework for retro-hunting. Tune the PowerShell branch to your environment's native-messaging broker process name; a chrome.exe-rooted process tree spawning powershell.exe that enumerates C:\ is the strongest signal of the backdoor.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Signed Epic Games Launcher Side-Loads Malicious [indicator] from %TEMP% — Exploitation (locked: unlock with TL Creds)
- Rogue Chrome Extension Force-Install and Native Messaging Host Persistence — Post-Exploitation (locked: unlock with TL Creds)
- Native Messaging Host Spawns PowerShell and Enumerates C:\ — Browser Sandbox Escape / Remote Command (locked: unlock with TL Creds)
- Invoice-Themed Script Dropper Chain: wscript to Signed Launcher to Hidden PowerShell — Exploitation (locked: unlock with TL Creds)
- Chrome Policy Allowlist + Native Messaging Host Registration (Cloud vn105rkj64) — Post-Exploitation (locked: unlock with TL Creds)
- Native Messaging Backdoor C2 to [indicator] with Session-Cookie Exfiltration — C2 / Exfiltration (locked: unlock with TL Creds)
- Double-Extension .pfd.js Dropper Executed by Windows Script Host — Exploitation (locked: unlock with TL Creds)
- Chrome Enterprise Policy Force-Install + Native Messaging Host Registration via HKCU — Post-Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `2.27.5[.]53`
- Domain: `ext2[.]info`
- File hash: `61f07213f2e54c54ec379714fd211c73`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Malware steals Chrome session cookies to take over your accounts](https://www.malwarebytes.com/blog/news/2026/06/malware-steals-chrome-session-cookies-to-take-over-your-accounts)
- [Malicious Chrome Extension Uses Native Messaging Host to Execute PowerShell Commands](https://cybersecuritynews.com/malicious-chrome-extension-uses-native-messaging-host/)
- [Hackers Use Malicious Chrome Extension to Break Out of Browser Sandbox](https://gbhackers.com/chrome-extension-to-break-out-of-browser-sandbox/)
- [Hackers Abuse Chrome Policy Keys to Force-Install Malicious Browser Extension](https://cyberpress.org/chrome-policies-force-extensions/)
- [New Malware Campaign Hijacks Chrome by Mimicking Administrative Policy Keys](https://the420.in/chrome-enterprise-policy-malware-extension-hijack-security-alert/)
- [Malicious Chrome Extension Uses Native Messaging Host to Execute PowerShell Commands (mirror)](https://www.cryptika.com/malicious-chrome-extension-uses-native-messaging-host-to-execute-powershell-commands/)
- [Chrome Native Messaging — developer documentation (mechanism abused)](https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0948