CTI · corroborated · 2026-08-13

Abyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC Access

Full story & timeline

MITRE ATT&CK

• T1219 Remote Access Tools Command and Control
• T1185 Browser Session Hijacking Collection
• T1555 Credentials from Password Stores Credential Access
• T1056 Input Capture Collection
• T1105 Ingress Tool Transfer Command and Control
• T1027 Obfuscated Files or Information Stealth

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• analysis.abyssos domain · expired
• capabilities.abyssos domain · expired
• communication.abyssos domain · expired

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://gbhackers.com/abyssos-rat-hijacks-browser-sessions/
• https://cyberpress.org/abyssos-rat-takes-control/
• https://malware.news/t/abyssos-technical-analysis-of-a-new-modular-rat/124653#post_1