Skip to navigation

Threat reportMalwareTL-2026-5574

Abe Office (AbeAgent.exe): Signed Modular RAT/Stealer Bypassing Chrome and Edge App-Bound Encryption via Hidden-Desktop Browser and Elevation Service Abuse

highACTIVE

Abe Office is a code-signed, modular Windows RAT and browser stealer (AbeAgent.exe) that bypasses Chrome/Edge App-Bound Encryption by launching a browser off-screen on a hidden desktop, injecting a helper DLL and asking the browser's own elevation service to decrypt the key.

Key facts

IdentifiersTL-2026-5574
Also known asAbe Office, AbeAgent, Abe Office Agent
SeverityHIGH
First disclosed
Affected productsGoogle Chrome (Windows); Microsoft Edge (Windows)
MalwareAbe Office
MITRE ATT&CK techniquesT1005 Data from Local System, T1027 Obfuscated Files or Information, T1036 Masquerading, T1036.005 Masquerading, T1041 Exfiltration Over C2 Channel, T1053.005 Scheduled Task, T1055 Process Injection, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1070.004 File Deletion, T1082 System Information Discovery, T1083 File and Directory Discovery and 18 more in the attack flow
MotivationUNKNOWN
Target sectorscross-sector
Target regionsUnknown
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5574 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Abe Office Hidden-Desktop Browser Launch (Off-Screen Window / Remote Debugging)

TL-2026-5574 (Abe Office / AbeAgent.exe). Detects Chrome, Edge, Brave, Opera or Firefox started with --window-position=-32000,-32000 (off-screen window used on the hVNC hidden desktop), or started with remote debugging against a cloned profile under C:\ProgramData\AbeOffice\SystemCache or by a process running from an AbeOffice folder. This is the core App-Bound Encryption bypass behaviour (T1555.003, T1539, T1055); a hit means browser passwords and session cookies should be treated as stolen.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1555.003, T1539, T1055
  • Data sources: sysmon, DeviceProcessEvents, windows_security_4688
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\brave.exe" OR Image="*\\opera.exe" OR Image="*\\firefox.exe") (CommandLine="*--window-position=-32000,-32000*" OR (CommandLine="*--remote-debugging-port=*" AND CommandLine="*\\ProgramData\\AbeOffice\\SystemCache*") OR (CommandLine="*--remote-debugging-port=*" AND ParentImage="*\\AbeOffice\\*")) | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host User Image | convert ctime(first_seen) ctime(last_seen) | table first_seen last_seen host User Image parent_images command_lines

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('chrome.exe','msedge.exe','brave.exe','opera.exe','firefox.exe')
| where ProcessCommandLine has '--window-position=-32000,-32000'
    or (ProcessCommandLine has '--remote-debugging-port' and (ProcessCommandLine has @'\ProgramData\AbeOffice\SystemCache' or InitiatingProcessFolderPath has @'\AbeOffice\'))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, SHA256

Sigma

title: Abe Office Hidden-Desktop Browser Launch With Off-Screen Window and Remote Debugging
id: b7a1c3d2-5e41-4f0a-9c1d-2a6e8f3b7d10
status: experimental
description: Detects a browser launched off-screen (--window-position=-32000,-32000) or with remote debugging against an Abe Office cloned profile, used to bypass Chrome and Edge App-Bound Encryption (TL-2026-5574)
references:
    - https://rogueauthority.org/signed-abe-office-agent-hidden-browser-stealer
    - https://cybersecuritynews.com/abe-office-malware/
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.defense-evasion
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\firefox.exe'
    selection_offscreen:
        CommandLine|contains: '--window-position=-32000,-32000'
    selection_debug:
        CommandLine|contains: '--remote-debugging-port'
    selection_abe_context:
        - CommandLine|contains: '\ProgramData\AbeOffice\SystemCache'
        - ParentImage|contains: '\AbeOffice\'
    condition: selection_browser and (selection_offscreen or (selection_debug and selection_abe_context))
falsepositives:
    - Browser automation or kiosk and digital-signage tooling that positions windows off-screen
    - Developer test frameworks using remote debugging
level: high

Known false positives:

  • Browser automation, kiosk or digital-signage software that deliberately positions windows off-screen
  • Developer or QA test frameworks (Selenium, Playwright, Puppeteer) launching browsers with remote debugging

Tuning notes: The off-screen position leg is high fidelity; the remote-debugging legs are scoped to the AbeOffice SystemCache path or an AbeOffice parent. Exclude known automation hosts and service accounts by host or User. Requires command-line logging (Sysmon EventCode 1 or Security 4688 with command line auditing).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Abe Office AbeAgent Execution, Self-Install and Signer Artifacts · unlock with TL Creds
  • Abe Office AbeBrowserShim Injection into Chrome or Edge · unlock with TL Creds
  • Abe Office RAT Tasking - Command Shells Spawned by AbeAgent · unlock with TL Creds
  • Abe Office Browser Profile Cloning and App-Bound Encryption Key Output · unlock with TL Creds
  • Abe Crypto Bridge Native Messaging Host Registration · unlock with TL Creds
  • Non-Browser Process in User-Writable Path Connecting to External TCP 9090 · unlock with TL Creds
  • Abe Office Persistence - Run Key, Scheduled Task and Firewall Rule · unlock with TL Creds
  • Abe Office C2 Connection to Known Servers (TCP 9090 / Abe Update Page) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 36 indicators of compromise for TL-2026-5574.

Sample indicators (3 of 36)

  • IP address: 2.26.230[.]54
  • File hash: eda3e8e4e87ccb0423886ae5cfd1d488481d4ce16ab5b5efdfbce6f9f1a35dd9
  • IP address: 87.199.195[.]141

Defanged, TLP:CLEAR. Full set of 36 indicators: unlock with TL Creds.

36 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Operators were observed driving hidden browsers straight to saved-password pages; the delivery method and actor are unknown.

Abe Office presents itself as an "Abe Office workstation helper" for a non-existent product. The signed starter, AbeAgent.exe, copies itself into the user's profile (%USERPROFILE%\AbeOffice\), relaunches from there, strips the Mark of the Web, creates an "Abe Office Sync" Run key and a scheduled task (both launching with --autostart), attempts to add an inbound firewall rule named "Abe Office Agent", and writes three encrypted add-ons (.abe1 files). Before loading them it sends a build ID and wrapped key to its server and waits for the add-on decryption key ("server key required"), so the capability modules are server-gated.

The three add-ons are AbeCapability.dll (main RAT: command execution through cmd.exe and PowerShell, file transfer, screenshots, directory listing, system info, module update, self-wipe, reboot), AbeHvcn.dll (hidden-desktop/hVNC module: a separate invisible Windows desktop on which Explorer, Chrome, Edge or Firefox are launched, with screenshots and mouse/keyboard input), and AbeBrowserShim.dll (a signed in-browser helper). A browser stealer component ("DC Styler") collects passwords, cookies and extensions from Chrome, Edge, Brave, Opera and Firefox per profile, uploads in chunks and searches for payment-card numbers.

App-Bound Encryption (ABE), introduced in Chrome 127 in July 2024, binds the cookie/password key to the browser's elevation service. Abe Office clones Chrome and Edge profiles to C:\ProgramData\AbeOffice\SystemCache\, launches the browser off-screen (--window-position=-32000,-32000, with remote debugging bound to 127.0.0.1), injects AbeBrowserShim.dll, which asks the browser's elevation service to decrypt the ABE key, and saves it to C:\ProgramData\AbeOffice\abe_job\key.dat. Fallback routes include injection into an already-open browser, an "Abe Crypto Bridge" extension (native messaging host com.abe.office.crypto) and Chrome helper programs. The name "Abe" most likely stands for App-Bound Encryption (analyst inference).

C2 uses a custom TCP protocol on port 9090 to 2.26.230.54 and 87.199.195.141, with roughly 2-second heartbeats. Every message is AES-encrypted, but the key is a hash of the default password AbeOffice-ChangeMe, which is embedded in the sample and also derives the per-build key that unwraps the add-ons; Rogue Authority decrypted all three add-ons offline and matched the live server key, so captured C2 traffic is decryptable. The first server hosts the operator panel and an "Abe Update" page on port 80 listing the four kit files; the second serves the same content. In a multi-day sandbox run, operators connected three times over about a day and a half, listed browsers, opened Chrome and Edge on the hidden desktop and went directly to saved-password pages (the sandbox held no credentials). VirusTotal links 133 files to the two servers (first seen mid-September to early November 2026), including 61 launcher-bootstrap-stub.exe and 49 app.zip files; the starter is signed with an SSL.com certificate issued to an individual (valid from 2026-10-26; file signed 2026-11-04) that has been reported to the CA. Delivery method, lure and operator identity are unknown, and no actor attribution is made in the sources.

Because hVNC and browser remote debugging act from the victim's own machine and IP, sign-ins from the victim's PC cannot be trusted by default; if the file was run, browser sessions must be treated as stolen.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1185 Browser Session Hijacking

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Masquerading; T1055 Process Injection; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1564.003 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Command and Control

T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573.001 Symmetric Cryptography

Impact

T1529 System Shutdown/Reboot

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

defense-impairment

T1553.002 Code Signing; T1553.005 Mark-of-the-Web Bypass; T1686 Disable or Modify System Firewall

Resource Development

T1588.003 Obtain Capabilities; T1608 Stage Capabilities

Remediation

Immediate actions

  • Block outbound TCP 9090 and all traffic to 2.26.230.54 and 87.199.195.141 at the perimeter; alert on HTTP to both IPs
  • Hunt for %USERPROFILE%\AbeOffice\ and C:\ProgramData\AbeOffice\ folders, the 'Abe Office Sync' Run value, the 'Abe Office Agent' firewall rule and processes started with --autostart
  • If AbeAgent.exe was run, treat all browser sessions as stolen: from a clean device sign out all sessions, change passwords (email first) and enable two-factor authentication
  • Isolate affected hosts and clean or reinstall the PC

Workarounds

  • Restrict execution of unsigned or unknown 'office helper' installers via application allow-listing
  • Monitor for unexpected injection into chrome.exe/msedge.exe and unexpected use of the browser elevation service

Longer-term hardening

  • Alert on browsers launched with --window-position=-32000,-32000 or with remote debugging bound to 127.0.0.1
  • Alert on non-browser processes reading Chrome/Edge Login Data, Cookies or Local State files
  • Do not trust sign-ins from the victim's own PC by default; enforce device-bound session and conditional-access controls
  • Block or flag binaries signed by the abused SSL.com certificate (serial 5CA1AA263B09E43D349B735343EB2FDC)

Affected and fixed versions

  • Google — Chrome (Windows)
    Vulnerable versions: Chrome 127+ App-Bound Encryption data on infected Windows hosts
  • Microsoft — Edge (Windows)
    Vulnerable versions: Edge profiles on infected Windows hosts

Timeline

Last updated · revalidated 1× · latest source

  • Google publishes App-Bound Encryption design for Chrome cookies on Windows (introduced in Chrome 127); infostealers such as Lumma and Vidar later claim bypasses per SpyCloud.
  • Earliest VirusTotal files linked to the Abe Office servers first seen (reported as mid-September 2026; exact day approximate).
  • SSL.com code-signing certificate issued to an individual becomes valid; later used to sign locked-ioc-21 and locked-ioc-18.
  • locked-ioc-18 (in-browser ABE helper) signed with the SSL.com certificate.
  • Approximate (early November): primary C2 port 80 begins serving the 'Abe Update' page listing the kit's files; the second server locked-ioc-20 (VDSINA) serves the same page.
  • locked-ioc-21 signed; only build observed with a real-CA certificate and the only file linked to locked-ioc-22.
  • Approximate (early November): in extended sandbox runs the operator connected three times over about 1.5 days, listed browsers/profiles and opened hidden Chrome and Edge at saved-password pages; no stealer execution or post-exploitation payload observed.
  • Rogue Authority publishes the analysis; certificate reported to the CA and listed on CertGraveyard; default password AbeOffice-ChangeMe shown to decrypt add-ons and C2 traffic.
  • GBHackers reports the campaign, crediting MalwareHunterTeam for the sample.
  • Cyber Security News reports the campaign: 133 VirusTotal files tied to the two C2 servers; delivery method still unknown.

Update history

Sources cited

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats