Memento Spyware Tied to Chrome Zero-Day Attacks

A zero-day vulnerability in Google’s Chrome browser, CVE-2025-2783, was exploited earlier this year using commercial spyware from Memento Labs, the successor to Hacking Team. Google patched the flaw after researchers at Kaspersky Lab reported it, and the attack campaign was named Operation ForumTroll, which targeted government and private sector entities in Russia and Belarus.

Researchers traced the malware used in the campaign to other attacks dating back to 2022, and a spyware program called Dante from Italian vendor Memento Labs was identified in a corroborating analysis. The exploit enabled a Chrome sandbox escape by exploiting a Windows OS quirk and by using pseudo handles to bypass protections, a finding described by Kaspersky’s Boris Larin.

Dark Reading notes that Dante shared similarities with the original Hacking Team spyware, Remote Control Systems, and that Memento Labs relaunched after acquiring Hacking Team in 2019. The report emphasises how the commercial spyware industry is driving many zero-day attacks against Google and other targets. According to Kaspersky, Larin warned this represents a new class of vulnerability with potential implications for other applications and Windows services.