As cited
Copy frozen at (site build).
threat intel
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
Elastic Security Labs tracked KREMLIN, a Brazilian banking malware operation active since May 2025, which deploys malicious Chrome and Edge extensions to steal banking credentials and session tokens. The toolkit evolves through seven campaigns, using multi-stage JavaScript loaders, custom C++ installers, and Ethereum smart contracts as dead-drop resolvers to maintain infrastructure. The malware bypasses Chrome's integrity checks by manually manipulating Secure Preferences files and regenerating cryptographic HMACs and App-Bound encrypted hashes to activate unsigned extensions.
Why it matters: Brazilian banking users and financial institutions face credential theft and session hijacking from KREMLIN's browser extensions; practitioners should monitor for malicious extension installation via suspicious lures, unusual Chrome profile modifications, and Ethereum smart contract queries used for command-and-control updates, particularly since the campaign is rapidly accelerating with over 1,500 known infections.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
Elastic Security Labs tracked KREMLIN, a Brazilian banking malware operation active since May 2025, which deploys malicious Chrome and Edge extensions to steal banking credentials and session tokens. The toolkit evolves through seven campaigns, using multi-stage JavaScript loaders, custom C++ installers, and Ethereum smart contracts as dead-drop resolvers to maintain infrastructure. The malware bypasses Chrome's integrity checks by manually manipulating Secure Preferences files and regenerating cryptographic HMACs and App-Bound encrypted hashes to activate unsigned extensions.
Why it matters: Brazilian banking users and financial institutions face credential theft and session hijacking from KREMLIN's browser extensions; practitioners should monitor for malicious extension installation via suspicious lures, unusual Chrome profile modifications, and Ethereum smart contract queries used for command-and-control updates, particularly since the campaign is rapidly accelerating with over 1,500 known infections.
- Source published
- First seen by Cybersecurity Tracker