Chrome Zero-Day Exploited to Deliver Italian Memento Labs' LeetAgent Spyware

According to new findings from Kaspersky, a now-patched Google Chrome zero-day flaw was exploited to deliver an espionage-related tool from Italian information technology and services provider Memento Labs, known as LeetAgent. The vulnerability, CVE-2025-2783, is a sandbox-escape with a CVSS score of 8.3 and was disclosed by Chrome in March 2025 as being actively exploited in a campaign named Operation ForumTroll targeting organisations in Russia.

The phishing approach used personalised, short-lived links inviting recipients to the Primakov Readings forum, with clicking through a Chrome or Chromium-based browser triggering the exploit to drop LeetAgent, which can connect to a command-and-control server via HTTPS and execute a range of tasks.

Memento Labs, headquartered in Milan and formed in 2019 after the merger of InTheCyber Group and HackingTeam, produced the LeetAgent backdoor, and investigators note overlaps with the later Dante spyware in terms of tradecraft and shared code. The attacks have been linked to a broader set of activity by the ForumTroll APT group, with some evidence suggesting wider use of Dante in other campaigns, although attribution remains unresolved.