Chrome Zero-Day Exploitation Linked to Hacking Team Spyware

Chrome’s first 2025 zero-day exploit, tracked as CVE-2025-2783, is linked to tools used in Hacking Team’s spyware lineage, with Kaspersky describing the campaign as Operation ForumTroll. According to Kaspersky, the attackers bypass Chrome’s sandbox to run shellcode, install a malware loader, and establish persistence by modifying the Windows registry to hijack the search order for COM objects.

The final payload, LeetAgent, is spyware capable of logging keystrokes, receiving commands over HTTPS, and stealing files, and it communicates with a C&C server hosted on Fastly[.]net. The campaign targeted organisations in Russia, using phishing emails masquerading as forum invitations to deliver links to exploits, and the threat actor behind Operation ForumTroll was not observed using Dante in this campaign, though Dante has appeared in other attacks, per the report.

LeetAgent has been used since at least 2022 in attacks on Russia and Belarus, with links to the broader Dante toolset and the Italian company Memento Labs (formerly Hacking Team).