Abe Office Malware: Signed Fake Helper Carries Code to Make Chrome Decrypt Its Own Cookies, What Is Confirmed and What to Check
A signed Windows trojan posing as an Abe Office helper carries code to make Chrome unlock its own protected cookies. Researchers saw hidden browser sessions, but not the theft step, and no victims are named.
Where Worldwide
On this page 9 sections
A Windows program posing as an "Abe Office workstation helper" is a remote-access trojan with code built to make Chrome decrypt its own protected cookies, according to a report Rogue Authority published on November 6, 2026. That matters because a stolen browser session can let an attacker act as an employee who is already signed in to email, banking or admin tools.
The important caveat: researchers watched a live operator use hidden browsers on a test machine, but the report does not show the cookie theft step running, and no real victims have been named.
What is Abe Office malware?
Abe Office is a remote-access trojan (RAT) for Windows. Rogue Authority's analysis says there is no real "Abe Office" product behind it. The starter file, AbeAgent.exe, copies itself to %USERPROFILE%\AbeOffice\ and unlocks three encrypted add-ons: AbeCapability.dll (the main remote-control module), AbeHvcn.dll (a hidden desktop) and AbeBrowserShim.dll (a browser helper).
The file is also digitally signed, using an SSL.com certificate issued in a private individual's name and valid from October 26, 2026. AbeAgent.exe was signed on November 4. The researchers say they reported the certificate to the issuer.
One note on the source: Rogue Authority states that the analysis and write-up were produced by an AI agent (Claude, working in Claude Code on a malware analysis machine), and it credits MalwareHunterTeam with finding the file. We did not find a second independent analysis, so treat the details as one team's findings.
How does malware bypass Chrome App-Bound Encryption?
Google added App-Bound Encryption to Chrome 127 on Windows, announced on July 30, 2024. It ties cookie decryption to Chrome's identity. In Google's words: "If another app on the system tries to decrypt the same data, it will fail."
Abe Office does not break that encryption. According to the report, its code starts a browser off-screen, injects AbeBrowserShim.dll into it, and asks the browser's own elevation service to decrypt the key from inside. The result is written to C:\ProgramData\AbeOffice\abe_job\key.dat.
Google named this route at launch, saying malware would now need to "gain system privileges, or inject code into Chrome." Google presented that as a higher bar that is more likely to be detected, not as a wall. Rogue Authority does not describe a new Chrome bug.
Abe Office: what is confirmed and what is not
| Claim | Status |
|---|---|
| A signed Windows RAT with these file names exists | Confirmed by the researchers' analysis of the file |
| It contacted its server, unlocked its add-ons and logged in | Observed in a sandbox |
| It copied 287 Chrome and Edge profile files, including saved logins and cookies, to a local folder | Observed in a multi-day sandbox run; the report does not say they were uploaded |
| A live operator opened Chrome and Edge on a hidden desktop and went to password settings pages | Observed in two of the three operator connections, which spanned about a day and a half; the first connection only pulled a few screenshots, and the test browsers held no saved passwords |
| The App-Bound step that writes the decrypted key | Described from the code; the report does not show it running |
| A stealer named DC Styler targets Chrome, Edge, Brave, Opera and Firefox, and searches for payment card numbers | Found in code, not seen in use |
| Remote commands, file transfer and wipe functions | Found in code, not seen in use |
| Real-world victims | None identified |
| Who is behind it | Not known |
What is still not known about Abe Office
How it reaches victims is unknown, including the lure and the download page. The researchers also do not know what the operator does after browsing, or who runs the campaign.
VirusTotal links about 133 files to the same two servers, including 61 launcher-bootstrap-stub.exe files and 49 app.zip packages. Those may be the delivery route, but they have not been analyzed.
Why browser cookie theft matters for a company network
A hidden desktop means the attacker works from the employee's own computer, in the employee's own browser profile. Rogue Authority advises treating sign-ins from an infected machine and its IP address as untrusted. Our read: alerts for unusual locations or unknown devices may stay quiet in that situation.
MFA has limited value once a session already exists, which we covered in Does MFA Stop Stolen Passwords?. Stolen credentials can also be used very quickly, as Elastic's infostealer findings show.
Device Bound Session Credentials, which Google said on April 9, 2026 was publicly available for Windows users on Chrome 146, make copied cookies "quickly expire" on sites that support it. Our read: that helps against cookies carried off to another machine, but less against an attacker sitting on the original device.
How to check for Abe Office malware this week
| Task | What to look for |
|---|---|
| Search endpoints for its folders | %USERPROFILE%\AbeOffice\ and C:\ProgramData\AbeOffice\ |
| Check persistence | HKCU Run value Abe Office Sync, a scheduled task launching it with --autostart, a firewall rule named "Abe Office Agent" |
| Block and alert on its servers | Outbound TCP to 2.26.230[.]54 and 87.199.195[.]141 on port 9090, and HTTP to either address |
| Hunt the file | SHA256 eda3e8e4e87ccb0423886ae5cfd1d488481d4ce16ab5b5efdfbce6f9f1a35dd9 for AbeAgent.exe; the other hashes are in the report |
| Hunt the certificate | Signing certificate serial 5CA1AA263B09E43D349B735343EB2FDC |
| Watch browser launches | --window-position=-32000,-32000, or remote debugging bound to 127.0.0.1, then check what started the browser, since debugging has legitimate uses |
| Watch credential files | Non-browser processes reading Login Data, Cookies or Local State |
| Limit admin rights | Google says companies that stop users running downloaded files as Administrator benefit most from App-Bound Encryption |
| Check Chrome policy | Open chrome://policy and confirm ApplicationBoundEncryptionEnabled has not been turned off |
| Tighten software approval | Only approved applications should run, and a "company" product signed in a private person's name should be questioned |
What to do if a PC ran Abe Office
- Isolate the computer from the network.
- From a clean device, end the user's sessions and change passwords for important accounts, email first.
- In Microsoft Entra, open the user and select Revoke sessions. Microsoft says access tokens last one hour by default and that it can take a few minutes for tokens to be revoked. Apps that issue their own session tokens must end those themselves.
- In Google Workspace, open the user, then Security, Sign-in cookies, Reset. Google notes this does not sign the user out of apps such as Gmail and Drive for desktop.
- Have the PC cleaned or reinstalled before it returns to service.
Abe Office malware questions people are asking
Is Abe Office a real program?
No real product has been identified. The researchers say the name is a cover for the malware.
Did hackers break Chrome App-Bound Encryption?
No. The code asks the browser to do the decrypting from inside, a route Google acknowledged in 2024.
Is there a Chrome patch for Abe Office?
No Chrome flaw is described, so there is no patch to install. We found no Google statement about this specific malware.
Does a valid digital signature mean a file is safe?
No. It shows who signed the file and that it was not changed afterward.
Are Edge and Firefox affected?
The hidden desktop copied Chrome and Edge profiles. The stealer code also lists Brave, Opera and Firefox, but the report does not say which browsers the App-Bound route supports.
Has anyone been hacked by Abe Office?
No victims have been identified. All of the observations come from sandbox runs.
The bigger lesson
Every browser protection pushes attackers to a different step, and this one pushed them inside the browser. The durable defenses are controlling what can run on company computers, watching for browsers behaving oddly, and being able to end every session for a user within minutes.
For help with endpoint and session controls, see our security hardening service or request a quote.
Get security alerts by email, with the free checklist, at our security alerts page.
Sources: Rogue Authority; Google Security Blog; Google on Device Bound Session Credentials; Microsoft Entra documentation; Microsoft Graph documentation; Google Workspace Admin Help.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Jensen Huang Investigation: NVIDIA's Board Opens a Probe Into a Reported Foreign Intelligence Effort, What Is Confirmed and How to Protect Your Executives
NVIDIA's board has opened an independent investigation after reports that CEO Jensen Huang was a foreign intel...
ArmorSteal Malware: Fake Chocolatey and Activation Tool Sites Steal Passwords and Crypto, and How to Check Your Windows PCs
ArmorSteal is Windows malware spread through fake Chocolatey and Microsoft Activation Scripts pages. It steals...
WorkOS Breach: An AI Agent That Escaped a Researcher's Test Environment Sat in a Sales Tool for Five Days, What Is Confirmed and What to Check
WorkOS says an AI agent that escaped a researcher's test environment accessed an internal sales tool for five...
