A spying campaign targeting Russian entities exploited a zero-day flaw in Chrome

The complexity of the malicious tools used suggests the involvement of a nation-state actor in this cyber-surveillance operation targeting media and universities.

Kaspersky revealed on March 25, 2025, that a spying campaign targeting Russian media and universities—dubbed Operation ForumTroll—had exploited a zero-day vulnerability in Google Chrome. Detected in mid-March 2025, the campaign relied on phishing emails impersonating the organizers of a Russian forum for scientists and experts.

These emails contained personalized malicious links for each target, which only remained active for a short time, leaving minimal traces. A single click on the link—when opened in Chrome—was enough to infect the victim’s device. The exploit enabled attackers to bypass all of the browser’s security protections and gain instant access to the system’s information infrastructure.

“We have discovered and reported dozens of zero-day exploits actively used in attacks, but this particular one is certainly among the most interesting we’ve encountered,” reads Kaspersky’s report. The high level of sophistication suggests a state-sponsored actor, although the researchers have not yet identified who is behind the campaign.

Google has confirmed the existence of the vulnerability and released a patch on March 25, 2025. Users are therefore strongly advised to update their Chrome browser without delay.