Kaspersky Exposes Chrome Zero-Day RCE (CVE-2025-2783) Delivering Memento Labs Spyware in ForumTroll Campaign

Kaspersky researchers uncovered a sophisticated espionage campaign, dubbed Operation ForumTroll, that exploited a zero-day in Google Chrome (CVE-2025-2783) to deliver commercial spyware linked to Memento Labs, formerly Hacking Team. The attackers began with personalised phishing emails inviting recipients to the Primakov Readings forum, and simply visiting the malicious site could infect the victim, according to Kaspersky.

The Chrome zero-day allowed bypassing the sandbox via an obscure Windows API flaw, using pseudo-handles such as -2 returned by GetCurrentThread() that were not properly validated by Chrome’s IPC mechanisms. After initial access, a multi-stage loader chain used a validator script with the WebGPU API to perform an elliptic-curve key exchange and decrypt the next payload hidden in fake JavaScript and font files, with persistence via COM hijacking to load malicious DLLs.

The decrypted payload, LeetAgent, acted as the spyware component, while Dante, a commercial spyware product by Memento Labs, formed the secondary payload; both were linked to the ForumTroll APT group, with attacks dating back to 2022 targeting entities in Russia and Belarus. The vulnerability has been patched in Chrome 134.0.6998.177/.178, and Mozilla later disclosed a similar issue (CVE-2025-2857) for Firefox, per Kaspersky.