Loading malware…
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT31 was the first observed user, on August 28, 2026, and later installed the LONGTALE malicious browser extension.
JungleBamboo — LONGTALE : Extension Chrome voleuse de credentials, se faisant passer pour “Google Gemini” (ID : ckiknalbeplpcpofpnabcnhjcegckfei). Installée via le loader SUPERSTOMP qui altère les Secure Preferences de Chrome.
SUPERSTOMP downloads and installs a malicious Chrome extension belonging to a malware family Volexity refers to as LONGTALE, which masquerades as a Google Gemini Chrome extension.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Trois vulnérabilités critiques ont été enchaînées : CVE-2026-85046 ... Type Confusion ... Chrome V8 ; CVE-2026-87491 ... échappement de sandbox WebAssembly dans Chrome V8.
LONGTALE : Extension Chrome voleuse de credentials, se faisant passer pour “Google Gemini” ... Installée via le loader SUPERSTOMP qui altère les Secure Preferences de Chrome.
The final exploit payload is shellcode to perform browser process injection and payload download; CVE-2026-85880 is used to inject code into the Chrome browser process.
The p2 payload is shellcode that reflectively loads a DLL to facilitate Windows kernel privilege escalation.
LONGTALE masquerades as a Google Gemini Chrome extension (ID: ckiknalbeplpcpofpnabcnhjcegckfei) to evade detection.
LONGTALE : Extension Chrome voleuse de credentials, se faisant passer pour “Google Gemini”.
The final exploit payload is shellcode to perform browser process injection and payload download; CVE-2026-85880 is used to inject code into the Chrome browser process.
LONGTALE ... Capacités : vol de credentials/cookies/sessions, keylogging, captures d’écran sur mots-clés.
LONGTALE ... Capacités : vol de credentials/cookies/sessions.
JungleBamboo delivered SUPERSTOMP, which installed the LONGTALE credential-stealing Chrome extension.
GRIMWEDGE can read files up to 5 MB, while LONGTALE collects cookies, storage tokens, navigation history, keystrokes, and session metadata.
LONGTALE ... Capacités : vol de credentials/cookies/sessions, keylogging, captures d’écran sur mots-clés.
LONGTALE ... Capacités : ... captures d’écran sur mots-clés.
LONGTALE records pasted clipboard text across all browser tabs.
GRIMWEDGE sends HTTP POST requests to its C2 with victim data and previous command output; HTTP responses contain JScript commands.
The injected command downloads msgbox.exe with curl; JungleBamboo's variant downloaded a different payload from its own infrastructure.
LONGTALE performs bulk exfiltration of keystrokes, cookies, storage data, navigation history, and session metadata to the C2 server at roughly 30-second intervals.
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.