Operation ForumTrol Known for Exploiting Chrome 0-Day Attacking Users With New Phishing Campaign

Operation ForumTrol is a targeted APT phishing campaign (reported October 2025) that impersonates the eLibrary service to deliver personalized archive files which execute a PowerShell-based loader; the loader downloads a DLL, installs it at %localappdata%\Microsoft\Windows\Explorer\iconcache\_.dll, gains persistence via COM Hijacking (HKCR\CLSID...\InProcServer32), and deploys the Tuoni remote-access framework. The attackers used domain aging, cloned pages, device checks, and decoy files to evade detection while focusing on Russian political scientists and researchers.