Chrome Zero-Day Exploited to Deliver Italian Memento Labs’ LeetAgent Spyware
According to recent Kaspersky discoveries, an espionage-related tool from Italian information technology and services business Memento Labs was distributed as a result of the zero-day exploitation of a now-patched security hole in Google Chrome.
The business revealed in March 2025 that the sandbox escape vulnerability, CVE-2025-2783 (CVSS score: 8.3), was being actively exploited as part of a campaign called Operation ForumTroll that targeted Russian organizations. Additionally, BI.ZONE tracks the cluster as Prosperous Werewolf and Positive Technologies tracks it as TaxOff/Team 46. Since at least February 2024, it has been known to be operational.
Phishing emails with customized, transient links inviting recipients to the Primakov Readings forum were used in the wave of infections. ...