In July 2022, someone sent Google a batch of malicious code that could be used to hack Chrome, Firefox, and PCs running Microsoft Defender. Later in November 2022, Google’s Threat Analysis Group, the company’s team that investigates government-backed threats, published a blog post analyzing those exploits and the Heliconia framework. Google’s researchers concluded that the code belonged to Variston, a Barcelona-based startup that was unknown to the public.