KREMLIN Malware Bypasses Browser Integrity Checks to Force-Install Extensions

KREMLIN malware is bypassing Chromium integrity mechanisms to force-install malicious extensions in Google Chrome and Microsoft Edge browsers, researchers at Elastic Security Labs have discovered. The toolkit is designed to steal sensitive information, including credentials and session tokens, by masquerading as legitimate browser add-ons.

Sophisticated Bypass of Chromium Security

The malware employs a documented but rarely observed technique to avoid detection. It waits for the browser to be idle or closed before copying a malicious extension directly into the browser’s profile directory. It then enables developer mode and adds the extension to the Chromium “Secure Preferences” file.

To bypass the cryptographic integrity checks that Chromium uses to detect unauthorised changes to these files, KREMLIN retrieves the browser’s own encryption keys. The malware then regenerates the necessary encrypted hashes and hash-based message authentication codes (HMACs), making the malicious extension appear as if it had been legitimately approved by the user.

Infection Chain and Data Theft Capabilities

The infection process typically begins when a target opens a JavaScript file disguised as a bank receipt, invoice, or business document. After passing anti-sandbox checks, the file triggers a fake error while simultaneously downloading Node.js and establishing persistence through a scheduled task. The malware then uses an Ethereum smart contract as a dead-drop resolver to retrieve the location of its additional payloads.

Once installed, the malicious extension, which masquerades as “AVSync,” performs several high-risk activities:

• Stealing cookies, local storage, and session storage
• Keylogging text entered into web forms, including passwords
• Capturing screenshots and page source code
• Enumerating open tabs and browsing history
• Intercepting HTTP request bodies and headers
• Injecting attacker-controlled HTML into websites

Beyond the extension, the KREMLIN toolkit also functions as an info-stealer, capable of archiving and exfiltrating browser databases, cookies, and the App-Bound cryptographic keys required to decrypt protected data.

Attribution and Scope of the Campaign

Researchers have linked KREMLIN to a Brazilian cybercrime operation that has been active since mid-2025. The group has been involved in at least seven distinct campaigns targeting users through lures impersonating 12 different banks. Elastic Security Labs has confirmed 1,515 infected systems, the vast majority of which are located in Brazil.

In recent iterations, the threat actors have deployed the REMCOS remote access tool (RAT), having previously used the Pulsar RAT. The attackers have also been observed abusing the Internet Archive service to host payloads hidden within JPEG images.