Executive Summary
In June 2026, a sophisticated phishing campaign targeting Italian users was identified using invoice-themed lures to deliver a multi-stage infection chain. The attack is notable for its use of Google Chrome's Native Messaging API to bypass the browser sandbox, effectively transforming a malicious browser extension into a full-featured remote command backdoor.
The infection begins with a JavaScript file that performs DLL side-loading via a signed Epic Games executable to launch PowerShell. The primary objective is the persistent installation of a Chrome extension named 'Cloud vn105rkj64', which communicates with a Native Messaging Host registered on the host system. This setup allows the attackers to steal authenticated session cookies and execute arbitrary system commands via PowerShell while appearing as legitimate browser traffic.
This technique is particularly dangerous because it leverages legitimate browser features and enterprise policy settings to maintain persistence and bypass traditional security boundaries. Organizations should be concerned about the ability of this malware to hijack authenticated sessions and gain a foothold for further lateral movement through its remote command capabilities.