Hackers Use Malicious Chrome Extension to Break Out of Browser Sandbox

A sophisticated malware campaign that combined a phishing lure, an obfuscated Windows JavaScript dropper, a malicious Google Chrome extension and a Native Messaging Host to effectively break the browser sandbox and execute arbitrary PowerShell commands on infected Windows machines.

The attack chain shows how legitimate platform features signed executables, enterprise extension deployment policies and Chrome’s Native Messaging API can be abused together to create a resilient, remote-command backdoor.

The campaign began with short Italian-language phishing emails claiming a ready invoice (subject line “Fattura #2818999851”).

Recipients saw what looked like a PDF but downloading it produced an obfuscated JavaScript file named with a deceptive extension, Fattura-2819889242.pfd.js, designed to appear like a .pdf at a glance.

When executed by Windows Script Host the JavaScript decoded and wrote two files into the user’s temporary directory: a legitimately signed Epic Games executable and a malicious d3d11.dll.

PowerShell prepared and installed a Chrome extension named Cloud vn105rkj64 (extension ID gghagmhimhgfeajfdmjkgmmehbokmglg) and modified Chrome enterprise policy keys ExtensionInstallAllowlist and ExtensionInstallSources so the extension appeared as an administrator-deployed component.

Extensions alone cannot spawn local processes, but Chrome’s Native Messaging feature provides a sanctioned bridge to native code.

D3 Lab said in a report shared with GBhackers, attacker used DLL side‑loading: the trusted signed executable launched normally but loaded the attacker-controlled DLL, which then launched a hidden PowerShell process

Chrome Extension to Break Out of Browser Sandbox

The attackers registered a Native Messaging Host (com.vn105rkj64.tr7qprrt7g) with a manifest pointing to a locally stored executable and permitted the malicious extension as an allowed origin.

The recipient that a requested invoice was ready for download and was signed by an accounting office. The visible document was presented as a 158 KB PDF.

Chrome then connected the extension to the host via a stdio channel and passed length-prefixed JSON messages; the native host executed PowerShell and returned results over the same channel.

Operational telemetry captured the extension contacting a command-and-control server at ext2[.]info. Initial exfiltration included Google cookies, open tabs and URLs, browser user-agent, language settings and a stable victim identifier data sufficient for session hijacking and profiling.

Subsequent controller instructions caused directory listings of C:\ to be returned, demonstrating that the extension-native host pairing functioned as an interactive remote-command backdoor rather than a simple information-stealer.

This technique matters because each abused component is legitimate and widely used: signed binaries can be side‑loaded, enterprises can push extensions via policy, and Native Messaging exists for legitimate integrations such as password managers.

Combining them restores the extension’s ability to affect the host OS while preserving a plausible-looking browser-side presence and HTTPS-based C2 communication, complicating detection and response.

Defenders should inspect unexpected Chrome enterprise policy entries and ExtensionInstallSources values, and enumerate Native Messaging hosts under HKCU\Software\Google\Chrome\NativeMessagingHosts.

Manifests’ allowed_origins reveal which extension may launch a host; unknown extension IDs paired with executables in user-writable locations are high-risk.

Endpoint monitoring should correlate events such as temporary csc.exe compilation activity, hidden PowerShell processes, changes to Chrome policy keys, DLL side-loading indicators and outbound POSTs to unusual domains including the extension’s origin header.

Incident response should not stop at removing the extension. Teams must unregister and delete the Native Messaging host, remove malicious executables and DLLs, review PowerShell logs, invalidate exposed browser sessions and rotate credentials where cookies or sessions may have been hijacked.

Indicators of Compromise

Type	Indicator	Context
Email subject	Fattura #2818999851	Italian invoice lure
Displayed filename	Fattura-26189991026.pdf	Document shown in the email
Payload filename	Fattura-2819889242.pfd.js	Obfuscated Windows JavaScript
Payload MD5	61f07213f2e54c54ec379714fd211c73	Initial JavaScript
Payload SHA-1	d7a2361877b9cd1f4b6ef56f59fb7adec72cc945	Initial JavaScript
Payload SHA-256	b11ef9f11c9bb6228582f38a61f4c04dc7160939d8c5b7ee4e467ffde6317f02	Initial JavaScript
Dropped filename	client_124578.exe	Signed application used for DLL side-loading
Dropped EXE SHA-256	e77747f06d1d3ee5b8466340a10416874439dd69a7e9cd8653647be7782899b6	Side-loading launcher
Dropped filename	d3d11.dll	Malicious side-loaded DLL
Dropped DLL SHA-256	94f333cba95e76e6b8c0f8831bffc446b5f3c90db2c598c6079a98f1a0ef9701	Malicious DLL
Extension name	Cloud vn105rkj64	Malicious Chrome extension
Extension version	2.0	Observed manifest version
Chrome extension ID	gghagmhimhgfeajfdmjkgmmehbokmglg	Allowed extension origin
Extension CRX SHA-256	d05e03173d9c841a28af60f5dda8a7c7a39c0a0d7302ec412ac4638b8f9872a3	Extension package
Native Messaging Host	com.vn105rkj64.tr7qprrt7g	Bridge between Chrome and Windows
C2 domain	ext2[.]info	Confirmed command-and-control server
Observed IP	2.27.5.53	Resolution observed during analysis
C2 request	POST https://ext2[.]info/time.php?q=ste_jstest2	Exfiltration and command channel
Related domain	cd-nwlins[.]site	Contacted during execution; returned parked content
Chrome policy key	HKCU\Software\Policies\Google\Chrome\ExtensionInstallAllowlist	Extension installation policy modified by malware
Chrome policy key	HKCU\Software\Policies\Google\Chrome\ExtensionInstallSources	Observed value: http://localhost:8080/*
Native host key	HKCU\Software\Google\Chrome\NativeMessagingHosts\com.vn105rkj64.tr7qprrt7g	Expected registration location for the host

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.