# Abe Office (AbeAgent.exe): Signed Modular RAT/Stealer Bypassing Chrome and Edge App-Bound Encryption via Hidden-Desktop Browser and Elevation Service Abuse

> Abe Office is a code-signed, modular Windows RAT and browser stealer (AbeAgent.exe) that bypasses Chrome/Edge App-Bound Encryption by launching a browser off-screen on a hidden desktop, injecting a helper DLL and asking the browser's own elevation service to decrypt the key. Operators were observed driving hidden browsers straight to saved-password pages; the delivery method and actor are unknown.

- **Published:** 2026-11-09T18:08:44Z
- **Last reviewed:** 2026-11-09T22:27:37.310Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5574
- **ID:** TL-2026-5574
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 36 (3 shown free below)

## Description

Abe Office presents itself as an "Abe Office workstation helper" for a non-existent product. The signed starter, AbeAgent.exe, copies itself into the user's profile (%USERPROFILE%\AbeOffice\), relaunches from there, strips the Mark of the Web, creates an "Abe Office Sync" Run key and a scheduled task (both launching with --autostart), attempts to add an inbound firewall rule named "Abe Office Agent", and writes three encrypted add-ons (.abe1 files). Before loading them it sends a build ID and wrapped key to its server and waits for the add-on decryption key ("server key required"), so the capability modules are server-gated.

The three add-ons are AbeCapability.dll (main RAT: command execution through cmd.exe and PowerShell, file transfer, screenshots, directory listing, system info, module update, self-wipe, reboot), AbeHvcn.dll (hidden-desktop/hVNC module: a separate invisible Windows desktop on which Explorer, Chrome, Edge or Firefox are launched, with screenshots and mouse/keyboard input), and AbeBrowserShim.dll (a signed in-browser helper). A browser stealer component ("DC Styler") collects passwords, cookies and extensions from Chrome, Edge, Brave, Opera and Firefox per profile, uploads in chunks and searches for payment-card numbers.

App-Bound Encryption (ABE), introduced in Chrome 127 in July 2024, binds the cookie/password key to the browser's elevation service. Abe Office clones Chrome and Edge profiles to C:\ProgramData\AbeOffice\SystemCache\, launches the browser off-screen (--window-position=-32000,-32000, with remote debugging bound to 127.0.0.1), injects AbeBrowserShim.dll, which asks the browser's elevation service to decrypt the ABE key, and saves it to C:\ProgramData\AbeOffice\abe_job\key.dat. Fallback routes include injection into an already-open browser, an "Abe Crypto Bridge" extension (native messaging host com.abe.office.crypto) and Chrome helper programs. The name "Abe" most likely stands for App-Bound Encryption (analyst inference).

C2 uses a custom TCP protocol on port 9090 to 2.26.230.54 and 87.199.195.141, with roughly 2-second heartbeats. Every message is AES-encrypted, but the key is a hash of the default password AbeOffice-ChangeMe, which is embedded in the sample and also derives the per-build key that unwraps the add-ons; Rogue Authority decrypted all three add-ons offline and matched the live server key, so captured C2 traffic is decryptable. The first server hosts the operator panel and an "Abe Update" page on port 80 listing the four kit files; the second serves the same content. In a multi-day sandbox run, operators connected three times over about a day and a half, listed browsers, opened Chrome and Edge on the hidden desktop and went directly to saved-password pages (the sandbox held no credentials). VirusTotal links 133 files to the two servers (first seen mid-September to early November 2026), including 61 launcher-bootstrap-stub.exe and 49 app.zip files; the starter is signed with an SSL.com certificate issued to an individual (valid from 2026-10-26; file signed 2026-11-04) that has been reported to the CA. Delivery method, lure and operator identity are unknown, and no actor attribution is made in the sources.

Because hVNC and browser remote debugging act from the victim's own machine and IP, sign-ins from the victim's PC cannot be trusted by default; if the file was run, browser sessions must be treated as stolen.

## MITRE ATT&CK

- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1553.005 Mark-of-the-Web Bypass
- T1553.002 Code Signing
- T1686 Disable or Modify System Firewall
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1036 Masquerading
- T1070.004 File Deletion
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1113 Screen Capture
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1082 System Information Discovery
- T1573.001 Symmetric Cryptography
- T1095 Non-Application Layer Protocol
- T1608 Stage Capabilities
- T1036.005 Masquerading
- T1027 Obfuscated Files or Information
- T1564.003 Hide Artifacts
- T1588.003 Obtain Capabilities
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1185 Browser Session Hijacking
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1529 System Shutdown/Reboot

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Abe Office Hidden-Desktop Browser Launch (Off-Screen Window / Remote Debugging)** (`TL-2026-5574-SPL-001`)

TL-2026-5574 (Abe Office / AbeAgent.exe). Detects Chrome, Edge, Brave, Opera or Firefox started with --window-position=-32000,-32000 (off-screen window used on the hVNC hidden desktop), or started with remote debugging against a cloned profile under C:\ProgramData\AbeOffice\SystemCache or by a process running from an AbeOffice folder. This is the core App-Bound Encryption bypass behaviour (T1555.003, T1539, T1055); a hit means browser passwords and session cookies should be treated as stolen.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1539, T1055
- **Data sources:** sysmon, DeviceProcessEvents, windows_security_4688
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\brave.exe" OR Image="*\\opera.exe" OR Image="*\\firefox.exe") (CommandLine="*--window-position=-32000,-32000*" OR (CommandLine="*--remote-debugging-port=*" AND CommandLine="*\\ProgramData\\AbeOffice\\SystemCache*") OR (CommandLine="*--remote-debugging-port=*" AND ParentImage="*\\AbeOffice\\*")) | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host User Image | convert ctime(first_seen) ctime(last_seen) | table first_seen last_seen host User Image parent_images command_lines
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('chrome.exe','msedge.exe','brave.exe','opera.exe','firefox.exe')
| where ProcessCommandLine has '--window-position=-32000,-32000'
    or (ProcessCommandLine has '--remote-debugging-port' and (ProcessCommandLine has @'\ProgramData\AbeOffice\SystemCache' or InitiatingProcessFolderPath has @'\AbeOffice\'))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: Abe Office Hidden-Desktop Browser Launch With Off-Screen Window and Remote Debugging
id: b7a1c3d2-5e41-4f0a-9c1d-2a6e8f3b7d10
status: experimental
description: Detects a browser launched off-screen (--window-position=-32000,-32000) or with remote debugging against an Abe Office cloned profile, used to bypass Chrome and Edge App-Bound Encryption (TL-2026-5574)
references:
    - https://rogueauthority.org/signed-abe-office-agent-hidden-browser-stealer
    - https://cybersecuritynews.com/abe-office-malware/
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.defense-evasion
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\firefox.exe'
    selection_offscreen:
        CommandLine|contains: '--window-position=-32000,-32000'
    selection_debug:
        CommandLine|contains: '--remote-debugging-port'
    selection_abe_context:
        - CommandLine|contains: '\ProgramData\AbeOffice\SystemCache'
        - ParentImage|contains: '\AbeOffice\'
    condition: selection_browser and (selection_offscreen or (selection_debug and selection_abe_context))
falsepositives:
    - Browser automation or kiosk and digital-signage tooling that positions windows off-screen
    - Developer test frameworks using remote debugging
level: high
```

**Known false positives:**

- Browser automation, kiosk or digital-signage software that deliberately positions windows off-screen
- Developer or QA test frameworks (Selenium, Playwright, Puppeteer) launching browsers with remote debugging

**Tuning notes:** The off-screen position leg is high fidelity; the remote-debugging legs are scoped to the AbeOffice SystemCache path or an AbeOffice parent. Exclude known automation hosts and service accounts by host or User. Requires command-line logging (Sysmon EventCode 1 or Security 4688 with command line auditing).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Abe Office AbeAgent Execution, Self-Install and Signer Artifacts (locked: unlock with TL Creds)
- Abe Office AbeBrowserShim Injection into Chrome or Edge (locked: unlock with TL Creds)
- Abe Office RAT Tasking - Command Shells Spawned by AbeAgent (locked: unlock with TL Creds)
- Abe Office Browser Profile Cloning and App-Bound Encryption Key Output (locked: unlock with TL Creds)
- Abe Crypto Bridge Native Messaging Host Registration (locked: unlock with TL Creds)
- Non-Browser Process in User-Writable Path Connecting to External TCP 9090 (locked: unlock with TL Creds)
- Abe Office Persistence - Run Key, Scheduled Task and Firewall Rule (locked: unlock with TL Creds)
- Abe Office C2 Connection to Known Servers (TCP 9090 / Abe Update Page) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 36)

Defanged, TLP:CLEAR.

- IP address: `2.26.230[.]54`
- File hash: `eda3e8e4e87ccb0423886ae5cfd1d488481d4ce16ab5b5efdfbce6f9f1a35dd9`
- IP address: `87.199.195[.]141`

Full set of 36 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [New Abe Office Malware Bypasses Chrome App-Bound Encryption to Steal Browser Passwords and Cookies](https://cybersecuritynews.com/abe-office-malware/)
- [Rogue Authority: Signed Abe Office agent, hidden browser stealer](https://rogueauthority.org/signed-abe-office-agent-hidden-browser-stealer)
- [Improving the security of Chrome cookies on Windows (Google Security Blog)](https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html)
- [SpyCloud: Infostealers bypass new Chrome security feature](https://spycloud.com/blog/infostealers-bypass-new-chrome-security-feature/)
- [Cyber Security News: Shadow hVNC gives attackers hidden desktop access](https://cybersecuritynews.com/shadow-hvnc-gives-attackers/)
- [Cyber Security News: Infostealers bypassing Chrome's cookie protection](https://cybersecuritynews.com/bypassing-chromes-cookie-protection/)
- [Group-IB: SilabRAT and HijackLoader (ABE bypass via COM elevation, comparable technique)](https://www.group-ib.com/blog/silabrat-hijackloader-trojan-malware/)
- [Ontinue: Behind a fake Claude Code installer (IElevator2 elevation-service ABE bypass, comparable technique)](https://www.ontinue.com/resource/blog-behind-a-fake-claude-code-installer/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5574