A banking malware operation linked to a Brazilian actor is using a tool called KREMLIN to install malicious extensions on Google Chrome and Microsoft Edge without displaying a user consent prompt. According to Elastic Security Labs, this operation has been active since mid-2025 and has conducted at least seven campaigns using lures impersonating 12 banks.
Infection begins when a user opens a JavaScript file that appears to be a bank receipt, invoice, payment record, or business document. After passing checks designed to detect analysis environments, the file displays a fake error while downloading Node.js, creating a scheduled task for persistence, and then obtaining the extension payload's location from a smart contract on the Ethereum network.
How Does the Malware Bypass Browser Protection?
KREMLIN waits for the browser to close, or terminates it when it detects an idle state, then copies the extension into Chrome and Edge profile directories. It subsequently enables developer mode and registers the extension in Chromium's Secure Preferences file.
The most notable aspect is its recreation of Chromium's configuration-integrity verification mechanisms. The malware uses the encryption keys relied on by the browser to protect sensitive data, then regenerates the required HMAC values and cryptographic hashes, making the extension appear valid to the browser even though it did not receive user consent. Elastic describes this technique as documented but rarely seen in malware.
An Extension Spying on Browsing Sessions
The installed extension disguises itself as AVSync and performs a wide range of data-collection operations, including:
- Stealing cookies, local-storage data, and session storage.
- Recording text entered into forms, including passwords.
- Capturing screenshots and web-page source.
- Enumerating open tabs and browsing history.
- Intercepting HTTP request bodies and headers.
- Injecting attacker-controlled HTML content and redirecting clicks.
- Receiving commands through a WebSocket connection.
The tool is not limited to the extension; it also collects browser databases, cookies, installed extensions, and the App-Bound encryption keys needed to decrypt some data.
Infrastructure and Campaign Scale
KREMLIN campaigns used Ethereum smart contracts as a mechanism for locating payloads and also concealed payloads inside JPEG images hosted through the Internet Archive service. In more recent campaigns, REMCOS was deployed as a remote-access tool, while earlier operations used Pulsar RAT; researchers believe the shift occurred because REMCOS is more feature-rich.
Elastic identified the Ethereum wallet that deployed and updated the smart contracts and said the wallet handled approximately 20,800 USDT in incoming transfers and 19,000 USDT in outgoing transfers. It also confirmed 1,515 infected systems, most of them located in Brazil.
Why Does This Matter?
The campaign is significant because it does not merely rely on tricking users into installing an extension; it tampers with browser files and security mechanisms so that the extension appears trusted. In practice, this means that the presence of an unfamiliar extension or the absence of a consent window is not, by itself, sufficient to detect the compromise. Editorially, this technique broadens the scope of session-data theft beyond direct password theft to active sessions, page content, and web requests, making the indicators of compromise published by Elastic important for investigations and response.
Elastic managed to disrupt the current campaign by registering a domain that the attackers used as a signal to check the analysis environment; the malware loader then interpreted systems eligible for infection as suspicious environments and stopped executing. The source does not establish that this action removed the entire infrastructure, but it halted the current campaign through this mechanism.