ZeroTrace Lab (researcher Smukx) demonstrates weaponizing Chrome Remote Desktop for covert access.
The chain patches remoting_core.dll to zero out the disconnect-notification dialog’s dimensions in the PE resources so the victim never sees the banner, then abuses the host.json config (which helpfully stores the RSA private key and PIN hash) to establish persistent backdoor access, delivered either via a doctored MSI installer or undocumented setup parameters.
It builds on Oddvar Moe’s practical guide at TrustedSec, which showed a year earlier how to install the host silently via MSI and get past the interactive PIN prompt, and which suggests application allowlisting and hunting for “Chrome Remote Desktop Host” in installed apps as countermeasures.
Google built the remote-monitoring feature; the red team just RSVP’d.
