Reported by 3 outlets

Timeline

1. original reporting

   Abyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC Access

   gbhackers.com · 63d ago · August 11th, 2026

   Abyssos, a modular C++ remote-access trojan that combines credential theft, browser-session hijacking, file exfiltration and hidden VNC control in a single post-compromise framework. Technical analysis from ThreatLabz indicates that Abyssos is designed for hands-on intrusion activity rather than opportunistic, single-purpose theft. The most concerning feature is its hidden VNC capability . The HVNC_START command opens a remote virtual desktop, while HVNC_INPUT allows the operator to simulate keyboard and mouse activity. Abyssos can launch applications within that isolated session, including Chrome, Edge, Firefox, Brave, Opera, Vivaldi, email clients and command shells. This provides attackers with an interactive foothold on compromised Windows endpoints without relying on the victim’s visible desktop. Browser takeover is central to the malware’s value. Through HVNC_CLONE_START , Abyssos copies browser data, including cookies, into a fontconfigs directory under the Windows temporary folder. Its chrome_cdp option launches Chrome with remote debugging enabled on port 9222, then uses the browser’s WebSocket interface and Network.setCookie API to inject stolen cookies from cookies.json . The mechanism can let operators assume an already authenticated browser session, potentially bypassing password prompts and, in some cases, multi-factor authentication tied to the session rather than a fresh login. Zscaler ThreatLabz Researchers said that , the malware is actively evolving across

2. update from malware.news

   Abyssos: Technical Analysis of a New Modular RAT

   malware.news · 64d ago · August 10th, 2026

   Introduction In late June 2026, Zscaler ThreatLabz identified a new malware family that we track as Abyssos. Abyssos is a new modular remote administration tool (RAT) written in C++ that supports a variety of features including credential theft, file exfiltration, and remote access via VNC. Abyssos is in active development with multiple version numbers and different obfuscation passes that are designed to improve evasion from security products.In this blog post, ThreatLabz provides a technical analysis of Abyssos, including its core features, configuration, obfuscation, network communication protocol, and capabilities. Key TakeawaysIn late June 2026, ThreatLabz identified a new malware family, Abyssos, which provides remote administration capabilities.Abyssos uses different intermediate representation (IR) passes, most likely using a publicly available LLVM obfuscator (e.g. Pluto) to thwart binary analysis.Abyssos uses a custom TCP protocol for network communication.Abyssos supports a number of different network commands and downloads additional modules from the command-and-control (C2) server to enhance its capabilities.Although not extensively used, ThreatLabz identified a few samples of Abyssos that implemented anti-analysis techniques.

3. update from cyberpress.org

   Abyssos: New Modular C++ RAT Combines Hidden VNC, Browser Hijacking, and Credential Theft

   cyberpress.org · 64d ago · August 11th, 2026

   Abyssos also steals browser sessions and credentials, exfiltrates files, logs keystrokes, and downloads additional modules from its C2, giving operators an interactive foothold for hands-on intrusion activity.

4. update from cyberpress.org

   C++ Abyssos RAT Gives Attackers Remote Shell, VNC and File-System Control

   cyberpress.org · 63d ago · August 11th, 2026

   Security researchers have identified a new modular remote access trojan (RAT) named Abyssos, a C++ malware family that gives attackers broad control over infected Windows systems. The malware is actively being developed, with researchers tracking several versions and different code-obfuscation methods. Its feature set includes remote shell access, hidden VNC sessions, file theft, browser-data collection, process control, keylogging support, and the ability to download extra modules from its command-and-control (C2) server. Once an attacker gains access to a target system, the RAT can collect host data, execute commands, move files, monitor activity, and expand its capabilities using encrypted plugins. Abyssos RAT Takes Control Abyssos uses several techniques to make reverse engineering harder and evade security analysis. Earlier samples check for virtualized environments by using the CPUID instruction to identify hypervisors such as VMware , KVM, Xen, and VirtualBox. The malware also searches for common virtual-machine processes, including vmtoolsd.exe , VBoxService.exe , and xenservice.exe . If detected, it exits. However, ThreatLabz noted that not every sample uses these anti-analysis checks. The newest observed version reportedly lacks them, showing that the malware is still changing during development.

5. update from cyberpress.org

   Abyssos RAT Hijacks Browser Sessions, Steals Credentials and Gives Attackers Remote VNC Access

   cyberpress.org · 62d ago · August 12th, 2026

   Abyssos operates as a post-exploitation framework. This technique can allow threat actors to hijack active web sessions without needing the victim’s password again. If a user is already logged in to email, cloud storage, financial services, or enterprise portals, stolen cookies may allow attackers to access those accounts as the victim.