Abe Office Malware Circumvents Chrome Security to Steal Data

A new cyber threat has emerged in the form of Abe Office, a remote-access trojan (RAT) that targets browser passwords and cookies. This sophisticated malware is capable of bypassing Chrome’s App-Bound Encryption, posing significant risks to user data. Marketed as an office assistant tool, Abe Office carries a legitimate code-signing certificate, adding to its deceptive nature.

Understanding Abe Office Malware

Research conducted by Rogue Authority has shed light on Abe Office’s operations. The primary executable, named AbeAgent.exe, masquerades as a workstation helper for a non-existent product. It is signed with a valid certificate from SSL.com under the name Kimberley Hankinson from Pennsylvania. Although the certificate ensures the file’s integrity post-signing, it does not guarantee safety. Patterns show that such certificates are often exploited in malware activities.

The term “Abe” likely refers to App-Bound Encryption, a Chrome security feature the malware is designed to bypass. Upon execution, Abe Office duplicates itself to the user’s profile folder, eliminating the Mark of the Web tag, which typically warns users about downloaded files. It configures startup entries and scheduled tasks, facilitating its persistent presence on the system.

Technical Breakdown and Defense Strategies

Three encrypted add-ons form the backbone of Abe Office. These include the main RAT, a hidden desktop component, and a browser helper. Each relies on a server-provided key for decryption, aimed at concealing their presence. However, researchers discovered a default password, AbeOffice-ChangeMe, which can derive all necessary keys, allowing defenders to decrypt these components.

The malware’s hidden desktop feature facilitates unauthorized access by replicating Chrome and Edge profiles, enabling the operator to impersonate the victim. This strategy circumvents “new device” alerts, thereby enhancing its stealth. During tests, operators accessed the sandbox environment multiple times, focusing on retrieving saved passwords.

Implications and Precautionary Measures

Google introduced App-Bound Encryption in Chrome 127 in mid-2024, designed to restrict system rights access. Nevertheless, Abe Office circumvents this by off-screen browser launching and DLL injection, tricking the system into providing encryption keys. These keys are stored locally, and backup strategies involve browser extensions like “Abe Crypto Bridge.”

Similar techniques have been observed in other malware strains, such as Lumma and Vidar, highlighting a growing trend in advanced cyber threats. The Abe Office command server, located at 2.26.230[.]54, hosts the control panel, with another server at 87.199.195[.]141 duplicating its functionality. These servers have been linked to numerous malicious files, suggesting an ongoing campaign.

Conclusion and Recommendations

Users who suspect exposure to Abe Office should consider their browser sessions compromised. It is crucial to log out from all accounts on a clean device, change passwords, and enable two-factor authentication. System administrators must monitor for specific AbeOffice folders and suspicious processes, blocking traffic to known command servers. Vigilance and proactive security measures are essential in mitigating the risks posed by this and similar cyber threats.