Loading malware…
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Chrome Secure Preferences integrity bypass present in LunexStealer initially raised a potential link to APT31’s SUPERSTOMP tool, documented by Volexity on 9 September 2026. We subsequently downgraded this assessment.
LONGTALE ... Installée via le loader SUPERSTOMP qui altère les Secure Preferences de Chrome.
JungleBamboo delivered a Chrome extension loader that Volexity refers to as SUPERSTOMP. SUPERSTOMP is a loader designed to download and install a Chrome extension.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Trois vulnérabilités critiques ont été enchaînées : CVE-2026-85046 ... Type Confusion ... Chrome V8 ; CVE-2026-87491 ... échappement de sandbox WebAssembly dans Chrome V8.
LONGTALE : Extension Chrome voleuse de credentials, se faisant passer pour “Google Gemini” ... Installée via le loader SUPERSTOMP qui altère les Secure Preferences de Chrome.
The final exploit payload is shellcode to perform browser process injection and payload download; CVE-2026-85880 is used to inject code into the Chrome browser process.
The p2 payload is shellcode that reflectively loads a DLL to facilitate Windows kernel privilege escalation.
The final exploit payload is shellcode to perform browser process injection and payload download; CVE-2026-85880 is used to inject code into the Chrome browser process.
JungleBamboo delivered SUPERSTOMP, which installed the LONGTALE credential-stealing Chrome extension.
UTA0560 télécharge msgbox.exe depuis cloud.shinewrist[.]net ; JungleBamboo déploie SUPERSTOMP depuis proof.gitprogram[.]com et photos.msbenefit[.]com.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.