A zero-day vulnerability in Google Chrome has been actively exploited by the hacker group Mem3nt0 Mori in a string of targeted attacks against high-profile organizations in Russia and Belarus.
The flaw allowed attackers to bypass Chrome’s sandbox protections and deploy spyware through phishing campaigns disguised as invitations to the Primakov Readings forum.
Kaspersky researchers stated, “The functionality of the malware suggests that the operation’s primary purpose was espionage.”
Operation ForumTroll
The vulnerability, CVE-2025-2783, affects Chrome versions prior to 134.0.6998.177 on Windows.
If exploited, the flaw allows attackers to execute arbitrary code, steal files, and install spyware without requiring downloads or user interaction.
Google patched the vulnerability, but active exploitation occurred before the update, according to Kaspersky’s findings.
These incidents — part of an operation Kaspersky calls Operation ForumTroll — targeted media outlets, financial institutions, and research universities, underscoring how threat actors increasingly use social engineering and commercial spyware for espionage.
Inside the attack chain
The attack began with personalized phishing emails in Russian that appeared to come from the Primakov Readings forum.
The links led to malicious websites that automatically triggered the exploit upon visit — no clicks or downloads required.
Once opened in Chrome, the exploit took advantage of a flaw in the browser’s Mojo inter-process communication (IPC) system, which handles data exchange between sandboxed components.
The issue stemmed from Chrome’s failure to properly validate pseudo-handles, such as the constant -2, used to reference the current thread.
This oversight allowed attackers to duplicate thread handles across sandbox boundaries, thereby granting them code-execution privileges in the higher-privileged browser process.
With this foothold, attackers deployed a persistent malware loader through Component Object Model (COM) hijacking, forcing Windows to load a malicious DLL disguised as a legitimate twinapi.dll.
The loader decrypted and launched a spyware payload, LeetAgent, which executed commands written in leetspeak.
LeetAgent allowed the attackers to:
- Log keystrokes and monitor clipboard data.
- Steal files with extensions like .docx, .pdf, and .xlsx.
- Inject shellcode into trusted processes like rdpclip.exe.
The spyware communicated with command-and-control (C2) servers hosted on Fastly[.]net cloud infrastructure, using obfuscation and encryption based on the ChaCha20 algorithm.
Kaspersky researchers linked this spyware to Dante, a commercial surveillance tool developed by Memento Labs, formerly known as Hacking Team, an Italian vendor associated with government spyware sales.
Building layers of browser defense
Google has patched the vulnerability in Chrome versions 134.0.6998.177 and 134.0.6998.178 and organizations should ensure the latest version of Chrome is being used.
Besides patching, organizations should adopt a layered defense strategy, including the following:
- Limit browser exposure: Restrict admin use, remove unneeded extensions, and use browser isolation to contain malicious code.
- Strengthen access controls: Apply least privilege, block admin browsing, and adopt zero trust to prevent successful lateral movement.
- Enhance detection and monitoring: Use EDR and SIEM tools to spot anomalies and IOCs like suspicious handles or Fastly traffic.
- Harden system and network defenses: Enable Windows Defender Exploit Guard, memory integrity, and secure gateways to block sandbox escapes.
- Reinforce social engineering awareness: Train users to spot common social engineering attacks.
Together, these measures can help organizations limit exploit paths, strengthen browser defenses, and build cyber resilience.
Commercial spyware fuels the next cyber arms race
This campaign highlights the growing convergence between zero-day exploits and the commercial spyware industry, creating a single, interconnected threat ecosystem.
Mem3nt0 Mori’s use of tools like LeetAgent and Dante demonstrates how surveillance technologies once sold to governments are now empowering state-aligned threat actors.
As cybercriminals and APTs weaponize browser vulnerabilities faster than vendors can patch them, the speed and consistency of response have become critical measures of cybersecurity resilience.
These evolving threats underscore the need for structured, tested incident response plans that enable organizations to react decisively under pressure.