New Abyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC Access

Abyssos, a modular C++ remote-access trojan that combines credential theft, browser-session hijacking, file exfiltration and hidden VNC control in a single post-compromise framework.

Technical analysis from ThreatLabz indicates that Abyssos is designed for hands-on intrusion activity rather than opportunistic, single-purpose theft.

The most concerning feature is its hidden VNC capability. The HVNC_START command opens a remote virtual desktop, while HVNC_INPUT allows the operator to simulate keyboard and mouse activity.

Abyssos can launch applications within that isolated session, including Chrome, Edge, Firefox, Brave, Opera, Vivaldi, email clients and command shells.

This provides attackers with an interactive foothold on compromised Windows endpoints without relying on the victim’s visible desktop.

Browser takeover is central to the malware’s value. Through HVNC_CLONE_START, Abyssos copies browser data, including cookies, into a fontconfigs directory under the Windows temporary folder.

Its chrome_cdp option launches Chrome with remote debugging enabled on port 9222, then uses the browser’s WebSocket interface and Network.setCookie API to inject stolen cookies from cookies.json.

The mechanism can let operators assume an already authenticated browser session, potentially bypassing password prompts and, in some cases, multi-factor authentication tied to the session rather than a fresh login.

Zscaler ThreatLabz Researchers said that, the malware is actively evolving across multiple builds, with version 2.4F offering a broad command set and layered obfuscation intended to frustrate both automated detection and reverse engineering.

Abyssos also supports modular credential theft. ThreatLabz identified commands for probable Chrome and Firefox credential-recovery components, a cookie-grabbing module, and a keylogger whose captured input is stored as windows_update_cache.json in the temporary directory.

Abyssos RAT Hijacks Browser

Additional modules suggest ambitions beyond initial access: one appears intended to locate domain controllers, another to scan for vulnerabilities, and an ELEVATE_SYS_TOKEN component may attempt to obtain SYSTEM-level privileges.

The RAT can also enumerate processes and network connections, monitor clipboards, archive files in memory, upload selected data, execute payloads, and establish a remote cmd.exe shell.

The operator channel is equally notable. Abyssos registers infected hosts with system architecture, hostname, username, integrity level, public IP address and country information, then maintains a custom TCP connection to its command-and-control server using recurring PING messages.

Network packets are primarily encrypted with AES-GCM using a hard-coded 32-byte key; downloaded plug-ins receive an additional AES-CBC or XOR decryption layer.

This proprietary protocol, rather than routine web traffic, gives defenders a useful hunting opportunity where endpoint telemetry and network inspection can expose distinctive encrypted TCP patterns.

To delay analysis, some samples use CPUID checks for VMware, KVM, Xen and VirtualBox and terminate when virtualization-related processes are present.

The malware also dynamically resolves Windows APIs by CRC32 hash and uses control-flow flattening, bogus control flow, encrypted integer constants and stack-based string obfuscation.

ThreatLabz assessed with medium-to-high confidence that its authors use an LLVM-based obfuscator such as Pluto, which transforms code into a functionally equivalent but significantly harder-to-analyse form.

Not every observed build contains the anti-analysis checks, underscoring the family’s ongoing development.

Defenders should prioritize alerts for suspicious Chrome debugging instances, unexpected cookie files under %TEMP%\fontconfigs, execution from temporary directories, and anomalous encrypted TCP beacons.

Teams should also investigate processes invoking fodhelper.exe or ICMLuaUtil, as Abyssos includes commands associated with UAC bypass attempts.

Its optional RDPWRAP module appears related to the open-source RDP Wrapper project, which can enable Remote Desktop host support and concurrent sessions; its presence on endpoints warrants immediate context-driven review.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide