KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension

KREMLIN is a banking malware operation that plants a hostile browser extension on infected computers. The extension can harvest passwords, session cookies, and other data that can let criminals enter online accounts.

The campaign begins with fake JavaScript documents that pose as bank records or invoices. Once opened, they install components and target Chrome and Edge profiles.

The lures are written in Portuguese and impersonate Brazilian banks and payment services. The activity has run across seven campaigns over 15 months. Researchers tracked 1,515 infected systems, 98.75 percent in Brazil.

Elastic said in a report shared with Cyber Security News (CSN) that their takeover of a network canary temporarily stopped those infections from advancing.

The name KREMLIN does not point to a Russian operation. Researchers assess the campaign is focused on Brazil, based on its language, bank-themed decoys, and activity patterns.

Its danger lies in combining familiar social engineering with browser-level access, a route that can bypass the caution users normally apply to suspicious log-in pages.

KREMLIN Banking Malware Infects Over 1,500 Systems

After an initial victim executes the lure, KREMLIN uses several stages to avoid analysis and load its installer. It checks whether the system looks like a sandbox, creates a scheduled task, and retrieves fresh hosting details from an Ethereum smart contract.

That setup makes it easier for operators to change infrastructure without rebuilding every sample. The installer copies the extension into Chrome and Edge profile folders, bypassing the official store.

It alters Chrome’s protected preferences and recreates the checks that normally verify extension settings. That allows the browser to treat the add-on as approved, even though the user never installed it.

The extension poses as AVSync and requests access to tabs, cookies, browser storage, and network requests. It can take screenshots, list open tabs, collect cookies and stored web data, capture typed text, and inject attacker-controlled content into pages.

Similar Brazilian browser extension attacks show why browser add-ons have become a valuable path to banking credentials.

It also archives browser databases and encryption keys before sending the data remotely. A stolen session cookie can let an intruder reuse an authenticated account.

Readers can compare the broader risk in malicious Chrome extension campaigns, where extensions abused extensive browser permissions to collect sensitive information.

Banking Lures and Response

Operators have evolved the toolkit since May 2025. Earlier campaigns delivered other remote access tools alongside malicious extensions, while newer activity used blockchain-hosted configuration and a signed security-program component to load an unsigned malicious file.

The shared infrastructure suggests coordinated control of the infection chain. The latest campaign targeted Brazilian users with filenames resembling receipts, payment records, bank statements, and instant-payment documents.

A fake error message can conceal the infection. That blend of believable paperwork and silent installation makes ordinary file-opening habits a security concern. Organizations should alert staff that banks and payment providers do not normally send JavaScript files as documents.

They should block script files received through email or messaging where possible, inspect scheduled tasks and browser profiles for unauthorized changes, and hunt for the indicators below.

Teams responding to a suspected infection should isolate the device, remove the malicious extension, reset affected passwords from a clean system, and revoke active sessions.

Users should review every installed browser extension and remove unfamiliar entries, especially add-ons with broad access to websites, cookies, or tabs. Use official banking apps or bookmarked sites, not message links.

This advice aligns with lessons from extensions stealing passwords and sessions, where changing credentials and revoking sessions from a clean device were critical after exposure. The temporary canary disruption gives defenders time, not a guarantee that the threat is gone.

KREMLIN’s use of changeable online configuration means defenders need to watch for behavior as well as block known infrastructure. Browser reviews, email filtering, endpoint monitoring, and session revocation can limit damage.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension appeared first on Cyber Security News.