Researchers have documented a new remote access tool that is built to sidestep passwords entirely. Zscaler's ThreatLabz team says it identified the malware, which it tracks as Abyssos, in late June 2026, and that the tool copies a victim's browser data and then replays their session cookies into a hidden browser window, letting whoever is at the other end use accounts the victim is already logged into.
Session cookies are the small tokens a website hands your browser to remember that you have signed in. Steal them and an attacker gets the account without the password and, in most cases, without triggering multi-factor authentication. Read the original ThreatLabz analysis for the full technical breakdown.
What Abyssos can do
Abyssos is written in C++ and is modular, meaning the core program is deliberately small and pulls extra capabilities down from its command and control server as needed. ThreatLabz says it is under active development, with several version numbers and different obfuscation passes observed across samples.
The headline feature is hidden VNC, a remote control mode that runs a desktop session the victim cannot see. Within it, the operator can launch Chrome, Edge, Firefox, Brave, Opera, Vivaldi and Internet Explorer, plus mail clients including Thunderbird and eM Client. One command starts Chrome with its debugging port open, connects to it and injects previously stolen cookies, which ThreatLabz states is done to hijack browser sessions. A separate command copies a chosen browser's folders and data, including cookies, ready for that replay.
Beyond browsers, the command set covers keylogging, clipboard capture, screen recording, a file manager that can list, delete, upload and download files, in-memory ZIP archiving of whole directories for exfiltration, process and network connection monitoring, and two user account control bypass techniques. It can also download and run further payloads, inject shellcode into a named process, and delete itself with a short ping delay to cover its exit. Additional modules described in the report were not available when ThreatLabz analysed the malware, so their purposes are given as assessments rather than confirmed behaviour, including likely credential harvesters for Chrome and Firefox, a domain controller locator and a privilege escalation module.
Built to frustrate analysis
Some Abyssos samples check for a hypervisor using the CPUID instruction and look for VMware, KVM, Xen and VirtualBox, then look for tell-tale guest processes such as vmtoolsd.exe and VBoxService.exe, terminating if any are present. ThreatLabz notes this is not universal, and the most recent version it examined dropped those checks. The binaries also use control flow flattening, bogus control flow and string obfuscation; ThreatLabz assesses with medium to high confidence that the developers are using a publicly available LLVM-based obfuscator such as Pluto.
Network traffic runs over a custom TCP protocol encrypted with AES in GCM mode using a hardcoded key, and the malware registers each new victim by sending the computer name, username, privilege level, CPU architecture, public IP and country before settling into a regular beacon.
What defenders should watch for
The cookie replay technique means password resets alone do not evict an intruder; active sessions have to be invalidated too. Watch for Chrome being launched with a remote debugging port on user endpoints, which is rare in normal use, and for unexpected files in the Windows temporary folder, where the keylogger writes captured keystrokes to a file disguised as windows_update_cache.json. Zscaler detects the family as Win64.PWS.Abyssos.
The published indicators, defanged: sample hashes 52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa (version 2.4F) and ca94d95413210a2a325155740eb8a5c58627ad5c4e704478621e7fc8165fe173 (version 2.1F), with command and control at 213[.]145[.]86[.]42 and 209[.]99[.]184[.]223.
Abyssos joins a run of freshly documented remote access tools aimed at the same prize, from AtlasRAT running entirely in memory to dodge antivirus to the campaigns raiding corporate browser logins with ACR Stealer. The browser, not the operating system, is where the valuable credentials now live.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.