Spreading Malware with Google: Nice Quilombo

Architecture and Background

Trusted desktop applications from reputable vendors often receive broad permissions and minimal scrutiny from endpoint detection and response (EDR) agents. Google Earth features advanced rendering engines, scripting capabilities, and embedded web components designed to deliver dynamic geographic visualizations.

Vulnerability Analysis

The researchers uncover an attack chain within Google Earth that allows adversaries to bypass client-side security sandboxes. By manipulating document handlers and memory management routines, an attacker can load arbitrary payloads directly into the execution context of trusted Google processes.

Exploitation and Demonstrations

Cuchietti and Sanchez demonstrate three specific exploitation scenarios: hijacking authenticated Google sessions, gaining remote code execution via interactive shells, and executing stealthy in-memory JavaScript malware configured for unauthorized Monero cryptocurrency mining without triggering disk-based heuristics.

Remediation and Defensive Strategies

Mitigating trusted-application abuse requires strict memory integrity controls, behavioral monitoring of child process spawning, and hardening sandbox boundaries for embedded WebViews. Security teams should enforce application whitelisting and monitor suspicious parent-child process relationships across productivity tools.