Malware steals Chrome session cookies to take over your accounts

1. Executive summary

A phishing campaign delivering a Windows backdoor via a malicious Chrome extension is actively targeting users. The malware abuses Chrome Native Messaging to bridge the browser sandbox and the host OS, enabling cookie theft, session hijacking, and remote command execution. Session cookie theft allows attackers to bypass MFA on already-authenticated accounts. EMEA financial services staff receiving invoice-themed phishing emails are at direct risk of account takeover on banking, SaaS, and internal platforms.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps from source)

1. Initial access — phishing email with disguised attachment. The victim receives an email containing an attachment named Fattura-2819889242.pfd.js, displayed in the mail client as Fattura-26189991026.pdf. The .pfd.js extension is deliberately crafted to resemble .pdf. The file is an obfuscated JavaScript file, not a PDF document.
2. Dropper execution — temp folder staging. When opened, the JavaScript file drops additional files into the temporary folder and initiates the infection chain. Two malicious files are referenced: client_124578.exe and d3d11.dll.
3. Chrome extension deployment via policy manipulation. A PowerShell script prepares a Chrome extension and modifies Chrome policy settings to force-install the extension. The installation is made to appear as an administrator-controlled deployment rather than a user-initiated extension install, suppressing normal user consent prompts.
4. Chrome Native Messaging abuse — sandbox escape bridge. The extension registers a native messaging host, creating a communication channel from the browser extension to a native host process on Windows. The extension does not launch PowerShell directly; instead, it sends messages to the native host, which then launches or interacts with PowerShell on the host system. This abuses a legitimate Chrome feature to turn the extension into a controller for local code execution.
5. Data collection. Once active, the extension and its native companion collect: browser cookies, open tabs, URLs, language settings, and fingerprinting data.
6. Remote command channel. The operators use the setup as a remote command channel, sending instructions that can launch PowerShell and enumerate the contents of the C: drive.
7. Session hijacking. Stolen authenticated session cookies allow attackers to hijack active browser sessions, accessing accounts already logged in on the victim's browser. This bypasses MFA because the session is already authenticated — the attacker replays the session cookie without needing to complete a fresh login flow.

Malicious artefacts identified

Confidence caveat: All technical detail in this advisory is single-sourced, originating from the Malwarebytes research report. No independent corroboration has been identified. Verify IOCs before enforcement deployment.

Attribution: No named threat actor is identified in the source material. No MITRE ATT&CK group reference is available. Attribution is unconfirmed.

4. Mitigation & containment

P1 — Within 24 hours

• Block the C2 domain at DNS, proxy, and firewall layers: ext2[.]info.
• Block the malicious extension ID via Chrome enterprise policy (ExtensionInstallBlocklist): gghagmhimhgfeajfdmjkgmmehbokmglg.
• Block the extension name pattern in web content filtering: Cloud vn105rkj64.
• Deploy EDR file-hash and filename rules for client_124578.exe and d3d11.dll — quarantine on sight.
• Block .pfd.js and .js attachments at the email gateway. Implement content-disposition inspection to flag files whose displayed name differs from the actual filename (e.g., displayed Fattura-*.pdf vs actual Fattura-*.pfd.js).
• Quarantine any endpoint showing the extension installed or communicating with ext2[.]info.

P2 — Within 72 hours

• Audit Chrome Native Messaging host registrations across the estate. Enumerate HKEY_CURRENT_USER\Software\Google\Chrome\NativeMessagingHosts\ and HKEY_LOCAL_MACHINE\Software\Google\Chrome\NativeMessagingHosts\ for unapproved host entries. Remove any not on the approved list.
• Review Chrome extension policies (ExtensionInstallForcelist, ExtensionInstallAllowlist, ExtensionInstallBlocklist) via GOM/ADMX. Ensure only approved extensions are force-installed. Investigate any unexpected entries.
• Audit all installed Chrome extensions on endpoints of finance, treasury, operations, and executive staff. Remove Cloud vn105rkj64 (ID: gghagmhimhgfeajfdmjkgmmehbokmglg) if found.
• Force session invalidation for high-value accounts (banking, SaaS admin, internal portals) accessed from any endpoint flagged in the audit. Sign users out to invalidate stolen session cookies.
• Review email gateway logs for messages containing Fattura-*.pfd.js attachments. Identify recipients and check their endpoints.

P3 — Within 7 days

• Restrict Chrome Native Messaging to approved, whitelisted native hosts only via enterprise policy. Disable the feature for unapproved extensions.
• Implement Chrome extension allowlist policy — block all extensions not explicitly approved by IT security.
• Deploy DLP rules to detect large cookie-file exfiltration or unusual outbound connections from chrome.exe or powershell.exe to non-corporate domains.
• Conduct targeted phishing simulation using invoice-themed lures to measure susceptibility among finance and operations staff.
• Review MFA coverage — while MFA does not prevent session-cookie replay, ensure step-up authentication and session timeout policies are enforced for critical financial applications.

5. Indicators of compromise

filename  Fattura-2819889242.pfd.js
filename  Fattura-26189991026.pdf
filename  client_124578.exe
filename  d3d11.dll
chrome-extension-name  Cloud vn105rkj64
chrome-extension-id  gghagmhimhgfeajfdmjkgmmehbokmglg
domain  ext2[.]info

6. Detection

rule Malwarebytes_Chrome_Native_Messaging_Cookie_Stealer {
    meta {
        author = "Adverse Trace"
        date = "2026-06-26"
        reference = "https://www.malwarebytes.com/blog/news/2026/06/malware-steals-chrome-session-cookies-to-take-over-your-accounts"
        description = "Detects malicious Chrome extension and dropped files from cookie-stealing backdoor delivered via phishing"
    }
    strings:
        $ext_name = "Cloud vn105rkj64" ascii
        $ext_id = "gghagmhimhgfeajfdmjkgmmehbokmglg" ascii
        $exe_name = "client_124578.exe" ascii
        $dll_name = "d3d11.dll" ascii
        $js_name = "Fattura-2819889242.pfd.js" ascii
        $domain = "ext2.info" ascii
    condition:
        3 of them
}

title: Detect Malicious Chrome Extension Cloud vn105rkj64 Installation
id: adtrace-2026-06-26-186-1
status: experimental
description: Detects installation of malicious Chrome extension via policy manipulation or native messaging host registration
author: Adverse Trace
date: 2026/06/26
logsource:
    product: windows
    category: registry_event
detection:
    sel_ext_id:
        TargetObject|contains: "gghagmhimhgfeajfdmjkgmmehbokmglg"
    sel_ext_name:
        TargetObject|contains: "Cloud vn105rkj64"
    sel_native_messaging:
        TargetObject|contains: "NativeMessagingHosts"
    condition: sel_ext_id or sel_ext_name or (sel_native_messaging and (TargetObject|contains: "client_124578" or TargetObject|contains: "d3d11"))
falsepositives:

    - Legitimate enterprise Chrome extension deployment
level: high

title: Detect Dropped Files from Chrome Cookie Stealer Backdoor
id: adtrace-2026-06-26-186-2
status: experimental
description: Detects creation of dropped files client_124578.exe and d3d11.dll in temp folders
author: Adverse Trace
date: 2026/06/26
logsource:
    product: windows
    category: file_event
detection:
    sel_exe:
        Image|endswith: "client_124578.exe"
    sel_dll:
        Image|endswith: "d3d11.dll"
    sel_temp_path:
        TargetFilename|contains:

            - "\\Temp\\"
            - "\\TEMP\\"
    condition: (sel_exe or sel_dll) and sel_temp_path
falsepositives:

    - Legitimate software using similarly named files (d3d11.dll is a common DirectX filename — verify path and signing)
level: medium

title: Detect Network Connection to ext2.info C2 Domain
id: adtrace-2026-06-26-186-3
status: experimental
description: Detects network connections to ext2.info associated with Chrome cookie-stealing malware
author: Adverse Trace
date: 2026/06/26
logsource:
    product: windows
    category: network_connection
detection:
    sel_domain:
        DestinationHostname|endswith: "ext2.info"
    sel_ip:
        DestinationHostname|contains: "ext2."
    condition: sel_domain or sel_ip
falsepositives:

    - None expected
level: critical

7. Sources

• Malwarebytes, "Malware steals Chrome session cookies to take over your accounts," https://www.malwarebytes.com/blog/news/2026/06/malware-steals-chrome-session-cookies-to-take-over-your-accounts, published 2026-06-26T12:44:01+00:00

8. Adverse Trace position

This is a credible, well-documented attack chain that poses a direct risk to EMEA financial services. The session-cookie theft mechanism is particularly significant because it bypasses MFA — the primary control most financial institutions rely on for remote access protection. The abuse of Chrome Native Messaging as a sandbox-escape bridge is a technique that few endpoint controls currently monitor. All technical detail is single-sourced from the Malwarebytes report; no independent corroboration has been identified at time of writing. No CISA-KEV entry, CVSS score, or CVE is associated with this item — it is a malware campaign, not a vulnerability disclosure. Attribution is unconfirmed; no named actor is identified. We are treating this as because the IOCs are specific and actionable, the attack chain is technically sound, and the targeting vector (invoice-themed phishing) aligns with known financial-sector attack patterns. Clients should deploy the IOCs to EDR and email gateways immediately, audit Chrome extension and Native Messaging configurations across the estate, and invalidate sessions on any compromised endpoint.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.