cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

KREMLIN Malware Bypasses Chrome and Edge Checks to Install Data-Stealing Extensions

· Original article ↗

Summary

Elastic researchers linked KREMLIN malware to a Brazilian operation that silently installs malicious Chrome and Edge extensions. They confirmed 1,515 infected systems and disrupted part of the campaign by registering an anti-sandbox domain.

Key points

  • The campaign has been active since mid-2025 and used bank-themed lures to trick targets into opening JavaScript files.
  • KREMLIN uses anti-sandbox checks, scheduled tasks, and Ethereum smart contracts to retrieve payloads and establish persistence.
  • The malware installs extensions by modifying browser profile files and recreating Chromium integrity checks, without user approval.
  • The extensions can steal cookies, passwords, session data, and browsing information, as well as capture screenshots and intercept web requests.
  • The toolkit can also archive and exfiltrate browser data and cryptographic keys; campaigns have deployed REMCOS and, previously, Pulsar RAT.
  • Elastic attributed the operation to a Brazilian threat actor, identified at least seven campaigns using lures for 12 banks, and confirmed 1,515 infected systems, almost all in Brazil.
  • Elastic disrupted the current campaign by registering a domain used as an anti-sandbox canary, causing the loader to stop on systems that would otherwise qualify for infection.

Article Details

Attack Vectors
  • A JavaScript file disguised as a bank receipt, invoice, payment record, or business document initiates the infection when opened.
  • The malware uses anti-sandbox checks, downloads Node.js, establishes persistence through a scheduled task, and retrieves additional payload locations from Ethereum smart contracts.
  • KREMLIN copies malicious extensions into Chrome and Edge profile directories and modifies Secure Preferences to make them appear approved.
  • The installed extension steals browser data, keylogs form input, captures screenshots, intercepts HTTP request data, injects attacker-controlled HTML, redirects clicks, and receives commands over WebSocket.
  • Campaigns have used Internet Archive to host payloads hidden in JPEG images; more recent campaigns deployed REMCOS, while earlier ones used Pulsar RAT.
Defensive Notes
  • Elastic Security Labs disrupted the current campaign by registering a domain used as an anti-sandbox canary, causing the loader to stop.
  • Review browser profile directories and Chromium Secure Preferences for unauthorized extensions or integrity changes.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelThe toolkit can exfiltrate archived browser data.T1053.005 · Scheduled TaskKREMLIN establishes persistence through a scheduled task.T1056.001 · KeyloggingThe installed extension keylogs text entered into forms, including passwords.T1113 · Screen CaptureThe extension captures screenshots.T1176 · Software ExtensionsKREMLIN installs malicious Chrome and Edge extensions by copying them into browser profile directories and modifying Secure Preferences.T1204.002 · Malicious FileThe infection begins when a user opens a JavaScript file disguised as a bank-related document.T1539 · Steal Web Session CookieThe extension steals browser cookies and session tokens.T1560.001 · Archive via UtilityKREMLIN can archive browser databases, cookies, installed extensions, and App-Bound cryptographic keys.

Malware

KREMLINA banking malware campaign active since mid-2025 has used the KREMLIN toolkit to silently install malicious Chrome and Edge extensions that steal credentials, session tokens, and browser data.Pulsar RATIn more recent campaigns, the threat actor deployed the REMCOS remote access tool, but past operations pushed the Pulsar RAT.Remcos#KREMLIN

Products

EdgeA banking malware campaign active since mid-2025 has used the KREMLIN toolkit to silently install malicious Chrome and Edge extensions that steal credentials, session tokens, and browser data.Google ChromeA banking malware campaign active since mid-2025 has used the KREMLIN toolkit to silently install malicious Chrome and Edge extensions that steal credentials, session tokens, and browser data.Node.jsAfter passing anti-sandbox checks, the file triggers a fake error while simultaneously downloading Node.js, establishing persistence through a scheduled task, and retrieving the additional payload location from an

Countries

Brazil#KREMLIN

Industries

BankingA banking malware campaign active since mid-2025 has used the KREMLIN toolkit to silently install malicious Chrome and Edge extensions that steal credentials, session tokens, and browser data.

Related Articles