Hidden Chrome Staging Directory Creation

Elgonad .@elgonad

•updated Jan 28, 2026•1•0•25

Detects the creation of a hidden directory under %LOCALAPPDATA%\Google Chrome. This technique is used by a Vietnamese threat actor associated with the PureRAT campaign to stage malicious components while blending in with legitimate application data.