Operation ForumTroll: How Memento Labs Used a Chrome Zero-Day for Global Spyware Attacks in 2024

In early 2024, a sophisticated cyber campaign, identified as Operation ForumTroll, exploited a Google Chrome zero-day vulnerability to deploy spyware linked to Memento Labs, an Italian commercial surveillance vendor. Attackers leveraged previously unknown browser flaws to quietly infect targets’ systems, enabling unauthorized espionage and data exfiltration. The malware was distributed through malicious websites and fully bypassed standard security defenses. This campaign has drawn special attention due to Memento Labs’ history—emerging from the notorious Hacking Team’s acquisition by IntheCyber Group—and its potential targeting of high-value individuals and organizations.

This incident underscores the persistent threat of zero-day attacks sponsored by private spyware vendors, and signals an ongoing trend in commoditized surveillance. The rise of commercial spyware and browser-based exploits increases regulatory scrutiny and highlights gaps in enterprise endpoint and data-in-transit security.

The exploitation of a Chrome zero-day by a commercial surveillance vendor demonstrates how easily unpatched software and sophisticated supply-side spyware can compromise even well-defended organizations. With browser zero-days increasingly trafficked and used for targeted attacks, enterprises must prioritize rapid vulnerability management, zero trust segmentation, and enhanced traffic monitoring now more than ever.