Critical Chrome 0-Day Under Attack: Mem3nt0 Mori Hackers Actively Exploiting Vulnerability

In March 2025, security researchers at Kaspersky detected a sophisticated campaign, dubbed Operation ForumTroll, exploiting a previously unknown Chrome vulnerability to deliver advanced spyware to high-profile targets. A single click on a malicious link could trigger infection via Google Chrome or any Chromium-based browser, with the attackers using ultra-short-lived personalised links to evade detection.

The vulnerability, tracked as CVE-2025-2783, was patched in Chrome 134.0.6998.177/.178 after Kaspersky linked the campaign to a sandbox-escape technique and to the Dante spyware toolset developed by Memento Labs.

The attack infrastructure relied on spear-phishing emails masquerading as invitations to the Primakov Readings forum and leveraged legitimate infrastructure providers to host command and control servers, targeting organisations across Russia including media outlets, universities, research centres, government agencies and financial institutions.

Firefox developers subsequently identified similar vulnerability patterns and released patch CVE-2025-2857; organisations are advised to update all Chromium-based browsers and review network logs for activity from March 2025 or earlier.