Researchers have uncovered a sophisticated malware campaign that abuses Chrome's enterprise policies and Native Messaging API to bypass browser sandbox limitations. By forcing a silent extension install, the attack establishes a bidirectional C2-linked PowerShell backdoor outside the browser.
Corporate identity compromise and unauthorized local endpoint control represent the ultimate operational risks for modern digital enterprises. A sophisticated malware campaign has been observed exploiting Google Chrome's administrative policies and its legitimate Native Messaging developer framework to bypass the native browser sandbox, executing unauthorized PowerShell commands directly on Windows hosts. Unlike traditional web-based threats that remain confined within the browser process, this attack chain establishes a bidirectional channel to the host operating system, giving threat actors an interactive backdoor that can lead to complete domain dominance and silent session hijacking.
For organizations operating across the GCC region, safeguarding endpoints against administrative registry abuse is critical. Threat actors can pivot from a single compromised browser instance to full enterprise network exploitation, bypassing standard web security boundaries. Addressing these gaps requires a deep understanding of browser-level configuration controls and robust endpoint detection strategies.
Phishing email drops Fattura-2819889242.pfd.js
wscript.exe launches Epic Games binary to load malicious d3d11.dll
PowerShell modifies Chrome registry keys to allow raw extension install
Chrome silently installs Cloud vn105rkj64 (ID: gghagmhimhgfeajfdmjkgmmehbokmglg)
PowerShell executes compiler (csc.exe) to generate Native Messaging Host
Bidirectional channel routes local shell commands to ext2.info C2
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
The commercial sale of SpyNote Pro Android RAT on underground forums highlights a growing mobile threat. Discover how this malware abuses accessibility services, performs dynamic payload execution, and executes overlay attacks to steal sensitive corporate credentials and bypass multi-factor authentication.
The alleged sale of the Stealc_v2 information-stealing malware source code on the exploit.in forum introduces major corporate security challenges. Featuring a PHP administration panel, customizable builders, and Telegram bot integrations, this leak enables rapid deployment of stealthy credential-harvesting campaigns.
June 25, 2026
A threat actor is selling the source code of the Predator 1.6 remote access trojan and file binder on the cybercrime forum Spear. This development lowers the technical barrier for deploying persistent backdoors, posing immediate security risks that demand behavioral EDR rules and path restrictions.
To identify and contain this specific style of sandbox breakout, security operations teams must monitor registry integrity, process creation anomalies, and directory execution patterns.
Monitor and alert on any write actions or new subkeys under the Native Messaging paths. The primary directory path to inspect is:
HKCU ext{Software} ext{Google} ext{Chrome} ext{NativeMessagingHosts} Security teams can run the following PowerShell query to audit registered hosts and ensure no unrecognized binaries are whitelisted:
Get-ChildItem -Path "HKCU:\Software\Google\Chrome\NativeMessagingHosts"Regularly audit system registries for enforced browser configurations that may bypass standard security checks. Check for active policies using this PowerShell command:
Get-ChildItem -Path "HKCU:\Software\Policies\Google\Chrome\ExtensionInstallAllowlist"Investigate any active keys that match the extension identifier gghagmhimhgfeajfdmjkgmmehbokmglg.
For organizations looking to thoroughly validate their endpoint security posture against sophisticated evasion techniques and policy tampering, undergoing a structured Penetration Testing engagement can expose hidden blind spots in group policy implementation and endpoint detection capabilities.
The campaign begins with targeted email lures designed to exploit typical business workflows. In observed cases, the attackers distribute phishing emails disguised as standard commercial invoices. The attached archive contains an obfuscated JavaScript file using a deceptive double extension pattern, such as Fattura-2819889242.pfd.js, which mimics a benign document to trick the recipient.
When an unsuspecting user executes the JavaScript payload, the local Windows Script Host (wscript.exe) handles the script, decoding and writing two distinct files directly to the user's temporary directory (%TEMP%):
client_124578.exe: A legitimate, digitally signed binary associated with Epic Games.
d3d11.dll: A rogue, attacker-controlled dynamic-link library designed to exploit binary dependencies.
By executing the signed Epic Games application from the temporary directory, the malware forces the operating system to load the malicious d3d11.dll instead of the system's legitimate graphics driver DLL. This technique, known as DLL side-loading, allows the attacker to execute arbitrary shell code under the guise of a trusted, digitally signed process, making initial endpoint detection difficult for basic antivirus tools.
Once the side-loaded DLL obtains execution rights, it initiates a hidden PowerShell process to tamper with Chrome's administrative registry structures. In enterprise environments, administrative policies allow central IT teams to force the installation of specific extensions or restrict their sources. The malware abuses these exact administrative mechanisms by writing direct policy overrides to the local Windows Registry.
The PowerShell script target-modifies the following registry paths:
HKCU ext{Software} ext{Policies} ext{Google} ext{Chrome} ext{ExtensionInstallAllowlist
HKCU ext{Software} ext{Policies} ext{Google} ext{Chrome} ext{ExtensionInstallSources
By setting these policy values, the malware permits Chrome to silently download and install extensions from local and unverified locations (specifically setting the allowed source to http://localhost:8080/*). Consequently, Google Chrome is forced to silently load a malicious browser extension named Cloud vn105rkj64, which carries the unique extension identifier gghagmhimhgfeajfdmjkgmmehbokmglg. Because the extension is loaded via enterprise policy, the user is neither prompted for approval nor given the ability to disable or remove the extension manually through the standard browser interface.
Standard Chrome browser extensions run inside a highly restricted, sandboxed environment that isolates them from the local filesystem, network sockets, and other operating system resources. To break out of this sandbox, the malicious extension exploits a legitimate, built-in integration feature known as the Native Messaging API.
The Native Messaging API is designed to let extensions communicate with local desktop applications using a basic standard input and standard output protocol. The malware configures this bridge through the following sophisticated sequence:
During the execution phase, the malware invokes the native Microsoft C# compiler (csc.exe) on the compromised system to dynamically build a tailored C# executable from source code dropped to disk. This newly compiled binary acts as the local Native Messaging Host, bypassing typical binary-signature checks since it is compiled locally by a trusted system compiler.
To register the host with Google Chrome, the installer creates a specific registry key under: HKCU ext{Software} ext{Google} ext{Chrome} ext{NativeMessagingHosts} ext{com.vn105rkj64.tr7qprrt7g. This key points directly to a JSON manifest file that defines the local path to the compiled C# executable and whitelists the rogue extension ID (gghagmhimhgfeajfdmjkgmmehbokmglg) as an allowed origin.
When the Chrome extension initializes, it utilizes the chrome.runtime.connectNative function to establish a connection with the registered host identifier. Chrome launches the local C# host process under the current user's security context and opens a dedicated, bidirectional stdio communication channel. This effectively destroys the browser sandbox: the extension can now send JSON-formatted commands to the local host executable, which translates them into arbitrary PowerShell commands executed directly on the host system.
Once the browser-to-host execution bridge is established, the threat actors obtain an interactive backdoor with direct system privileges. The extension contacts its Command and Control server at ext2[.]info, sending initial reconnaissance data, system details, active URLs, and stolen browser cookies. This capability facilitates immediate session hijacking, allowing attackers to duplicate active logins for critical corporate portals, cloud platforms, and internal services without triggering multi-factor authentication checks.
If you suspect that your organization's domains or credentials have already been exposed to underground markets via this campaign or similar info-stealing tactics, you should evaluate your current exposure immediately. Free domain exposure scan: Use FemtoSec's Dark Web Scanner to check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain. Implementing proactive Dark Web Monitoring is also crucial to alert security teams when employee browser sessions or corporate credentials appear on underground markets.
The operational techniques used in this campaign align directly with established adversary patterns:
Initial Access: Spearphishing Attachment (T1566.001) and User Execution of a Malicious File (T1204.002).
Execution: Scripting via JavaScript (T1059.007) and PowerShell Command Execution (T1059.001).
Persistence & Evasion: DLL Side-Loading (T1574.002), Registry Tampering (T1112), and Rogue Browser Extensions (T1176).
Credential Access: Web Session Cookie Theft (T1539) to facilitate session hijacking.
Command and Control: Application Layer Web Protocols (T1071.001) utilizing HTTPS channels to the remote C2 server.
If an endpoint is confirmed to be infected by the malicious browser extension or the side-loaded DLL payload, execute the following containment procedures immediately:
Network Isolation: Isolate the affected workstation from the corporate network to terminate active bidirectional backdoor connections to the C2 domain ext2[.]info.
Process Termination: Terminate any active instances of the Microsoft C# compiler (csc.exe) spawned by PowerShell, as well as the rogue signed binary processes running inside the temporary directory path (%TEMP%\client_124578.exe).
Registry Cleanup: Delete the rogue Native Messaging Host registry keys and associated extension allowlist entries under HKCU\Software\Policies\Google\Chrome\.
File Deletion: Permanently delete the malicious files from the temporary user profile folder, specifically targeting %TEMP%\client_124578.exe and %TEMP%\d3d11.dll, and remove the local extension directory located within the user's Chrome AppData directory.
Active Session Revocation: Because the primary impact of this threat involves session cookie exfiltration, the compromised user's active browser sessions must be terminated globally. Revoke all active OAuth tokens, invalidate existing session cookies, and perform an immediate password reset for all enterprise resources accessed from that device.