KREMLIN Malware Forges Chromium Integrity Checks to Install Banking-Theft Extensions
Summary
Elastic researchers traced KREMLIN malware targeting Brazilian banking users through malicious Chrome and Edge extensions. Registering its sandbox-check domain temporarily disrupted execution, with 1,515 infected systems observed contacting it.
Key points
- Elastic tracked seven REF9334 campaigns dating to May–June 2025, linking activity through shared infrastructure, installer behavior, extension code, and campaign identifiers.
- Victims manually execute JavaScript lures impersonating banking or business documents. Staged loaders download additional components, use Node.js, and establish persistence through scheduled tasks.
- KREMLIN installs extensions directly into Chrome and Edge profiles, modifies Secure Preferences, and regenerates integrity values using recovered encryption keys and a seed from resources.pak.
- The installer exfiltrates browser credential and cookie databases alongside decryption keys. The extension supports keylogging, cookie and storage theft, screenshots, HTML injection, redirection, and request interception.
- Ethereum smart contracts provide dynamically updated payload locations and C2 configuration. Some delivery chains sideload a malicious DLL through the legitimate SentinelMemoryScanner.exe binary; others deploy PULSAR or REMCOS RAT.
- Portuguese-language lures impersonate Brazilian financial institutions. Researchers consider Brazil a plausible operator location based on language artifacts and Ethereum transaction timing, not confirmed attribution.
- Threat Command registered a previously unregistered sandbox-check domain, causing contacting malware to crash. It observed 1,515 infected systems, 98.75% in Brazil; the disruption was temporary and did not remove installed components.
Article Details
- Attack Vectors
- Users manually execute JavaScript files disguised as banking receipts, statements, invoices, or company documents, initiating staged payload downloads.
- Loader variants execute PowerShell, Node.js, and RunPE stages; some deliver additional payloads through JPEG carriers hosted on Internet Archive.
- A legitimate signed executable sideloads an unsigned malicious DLL masquerading as one of its components.
- The installer copies malicious extensions into browser profiles and forges Secure Preferences integrity values to activate them without user approval.
- An alternative extension displays attacker-supplied QR codes on selected websites and asks users to reauthenticate; researchers could not determine what the codes encode.
- Defensive Notes
- The scheduled tasks MicrosoftNodeRuntimeUpdater and AcrobatBrowserExtension provide source-supported persistence artifacts for investigation.
- Browser-profile investigations should examine unexpected extensions, developer-mode changes, altered Secure Preferences integrity values, and browser launches under a debugger with --no-startup-window.
- The extension configuration field ENDPOINT_DINAMIC and the loader filename pattern popup_{date}_{random}.js can help identify related samples.
- Threat Command registered the previously unregistered network-canary domain, causing responding implants to interpret connectivity as sandbox activity and crash. Researchers observed 1,515 systems contacting it, 98.75% from Brazil.
- The canary intervention temporarily disrupted execution but did not remove installed malware; the article explicitly notes that affected systems remain infected.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | acrobat-updater[.]com | Fake plugin lure and staged payload infrastructure, also used by a recurring persistence task. |
| DOMAIN | codecaudiog[.]site | Loader infrastructure distributing malicious installers in the June 2025 activity. |
| DOMAIN | codecvideowin[.]online | Infrastructure providing malicious extension identifiers and extension archives. |
| DOMAIN | connection[.]upgradeonline[.]site | Malicious loader beaconing and extension-delivery infrastructure. |
| DOMAIN | cremeb[.]com | Malware infrastructure supplying QR-code content to the malicious QR-themed extension. |
| DOMAIN | granderevolucao[.]store | Malicious installer hosting domain distributed through Ethereum configuration. |
| DOMAIN | luizestrelhashapr[.]online | C2 endpoint returned by the analyzed extension's dynamic resolver. |
| DOMAIN | volmira[.]site | Infrastructure serving the malicious extension and receiving stolen browser data. |
| DOMAIN | zaviro[.]online | Smart-contract-configured payload infrastructure and browser-data exfiltration destination. |
facebook-br@protonmail[.]com | Uploader email recorded in metadata for the account hosting malicious RunPE JPEG carriers. | |
| HOSTNAME | graph[.]checkeligibitily[.]workers[.]dev | Attacker-used resolver endpoint returning the malicious extension's final C2 address. |
| HOSTNAME | orange-sun-195a[.]checkeligibitily[.]workers[.]dev | Attacker-used resolver returning separate WebSocket and HTTP C2 endpoints for earlier extensions. |
| HOSTNAME | seguranca[.]versionnova[.]site | Infrastructure used by a parallel KREMLIN variant to deliver staged payloads and receive loader beacons. |
| HOSTNAME | version[.]checkeligibitily[.]workers[.]dev | Attacker-used worker endpoint contacted by an installer to download the malicious extension. |
| IPV4 | 144[.]172[.]112[.]239 | PULSAR C2 address used on port 4782 in the August 2025 activity. |
| IPV4 | 178[.]92[.]162[.]38 | REMCOS RAT C2 address used on port 443. |
| IPV4 | 185[.]221[.]23[.]133 | PULSAR C2 address observed using ports 4782 and 443. |
| IPV4 | 37[.]16[.]74[.]100 | PULSAR 2.4.5 C2 address used on port 443. |
| IPV4 | 37[.]16[.]74[.]34 | Additional PULSAR 2.4.5 C2 address used on port 443. |
| IPV4 | 45[.]90[.]13[.]210 | PULSAR C2 address used on port 443 in the August 2025 activity. |
| SHA256 | 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 | Analyzed multi-stage JavaScript loader that initiates the KREMLIN infection chain. |
| SHA256 | 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca | Analyzed malicious browser extension supporting interception, credential capture, and remote commands. |
| SHA256 | 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9 | PowerShell reimplementation of the malicious extension installer that generates browser integrity values. |
| SHA256 | c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 | Analyzed native KREMLIN browser-extension installer. |
| URL | hxxps[:]//archive[.]org/download/hotelmoskva/hotelmoskva.jpg | Specific hosted JPEG carrier containing the RunPE process-injection module. |
| URL | hxxps[:]//archive[.]org/download/operagarnier/operagarnier.jpg | Specific payload-carrier resource recorded in the malware smart contract's steganography configuration. |
| URL | hxxps[:]//ia601808[.]us[.]archive[.]org/5/items/sentinel_20260722_0435/Sentinel.jpg | Specific JPEG carrier holding the CAB package used in the malicious DLL-sideloading chain. |
| URL | hxxps[:]//volmira[.]site//api/savecreds | C2 endpoint receiving encrypted browser-data archives, customer identifiers, and archive decryption material. |
| URL | hxxps[:]//volmira[.]site/api/ext?p=98d8049e-804f-11f1-b79f-ae3a8bb85d01 | Malicious extension ZIP download URL containing the installer customer identifier. |
| URL | hxxps[:]//zaviro[.]online//api/v1/fingerprint | Additional C2 endpoint receiving encrypted stolen browser data and associated decryption material. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelStolen browser archives are uploaded to C2 endpoints, and extension-collected data is transmitted through its HTTP and WebSocket communications.T1053.005 · Scheduled TaskMicrosoftNodeRuntimeUpdater runs at logon; AcrobatBrowserExtension runs at logon and every 30 minutes.T1055 · Process InjectionInstallers inject DonutLoader shellcode into explorer.exe; a later RunPE variant uses Early Cascade Injection into that process.T1056.001 · KeyloggingThe extension attaches input listeners to input and textarea elements and sends captured text to its server.T1059.001 · PowerShellSeveral infection chains execute PowerShell scripts to retrieve payloads and invoke RunPE assemblies.T1059.007 · JavaScriptJavaScript loaders execute through WSH and downloaded Node.js runtimes.T1105 · Ingress Tool TransferLoaders download Node.js, installers, extension archives, and JPEG-carried payloads from remote infrastructure.T1113 · Screen CaptureThe extension captures selected or active browser tabs and uploads compressed screenshots.T1176 · Software ExtensionsKREMLIN installs malicious extensions directly into Chrome and Edge profiles and regenerates integrity values to activate them.T1204.002 · Malicious FileVictims manually execute JavaScript files disguised as banking or company documents.T1497.001 · System ChecksLoaders check desktop-file counts, process counts, hardware properties, and a network canary to detect artificial environments.T1539 · Steal Web Session CookieThe installer exfiltrates browser cookie databases, while extension commands steal cookies from selected or active tabs.T1555.003 · Credentials from Web BrowsersThe installer steals browser Login Data databases and recovers OSCrypt keys needed to decrypt protected fields.T1574.002 · DLL Side-LoadingSentinelMemoryScanner.exe sideloads the unsigned malicious payload disguised as SentinelAgentCore.dll.T1620 · Reflective Code LoadingPowerShell loads RunPE as a .NET assembly, and earlier RunPE versions manually map payloads and call their entrypoints.
Threat Actors
Kr3mlin4rt1stCredited as KREMLIN's author in a malicious loader header; the article distinguishes the toolkit's developers from possible separate operators.REF9334Tracked banking-malware operation using KREMLIN and distributing PULSAR and REMCOS RAT. Researchers assess that its operators may be based in Brazil.
Malware
KREMLINElastic Security Labs tracked REF9334, a Brazilian banking malware operation using the KREMLIN toolkit to deliver malicious browser extensions, credential theft, and staged loaders through JavaScript, Node.js, RunPE,Pulsar RATTheir operations include installing malicious browser extensions and distributing PULSAR and REMCOS RAT.Remcos RATTheir operations include installing malicious browser extensions and distributing PULSAR and REMCOS RAT.
Vendors
Products
ChromiumThe malware bypasses Chromium integrity protections by modifying Secure Preferences and regenerating HMACs and encrypted hashes.EdgeOver 15 months and seven campaigns, they built a malicious browser extension that installs itself in Chrome and Edge, and the browser then loads it as though the user approved it.Google ChromeOver 15 months and seven campaigns, they built a malicious browser extension that installs itself in Chrome and Edge, and the browser then loads it as though the user approved it.Node.jsto deliver malicious browser extensions, credential theft, and staged loaders through JavaScript, Node.js, RunPE, and Ethereum-based infrastructure.