Since mid-2025, a banking malware campaign has leveraged a toolkit designated KREMLIN to deploy malicious extensions on Chrome and Edge browsers, targeting credential theft, session token harvesting, and sensitive data exfiltration. Elastic Security Labs determined that these extensions evade Chromium's built-in integrity mechanisms, appearing to browsers as legitimately installed despite never receiving user consent.
The attack begins when a target executes a JavaScript file masquerading as banking documentation—receipts, invoices, payment confirmations, or business records. Once the file clears anti-sandbox detection, it triggers a fabricated error message while simultaneously pulling down Node.js, establishing persistence via scheduled task, and fetching additional payload details from an Ethereum smart contract.
Despite its name, KREMLIN originates from a Brazilian threat actor that has conducted at least seven campaigns beginning in May 2025, using social engineering lures impersonating 12 financial institutions.
Sidestepping browser approval mechanisms
KREMLIN's most notable capability involves installing browser extensions without triggering user approval dialogs. The malware monitors browser activity, either waiting for closure or forcing termination when detecting idle periods, then copies the extension into the browser's profile directories. It subsequently activates developer mode and registers the extension within Chromium's Secure Preferences configuration.
To conceal this activity, the malware extracts the encryption keys that browsers employ to safeguard configuration data, then replicates the integrity verification mechanisms Chrome uses to identify preference modifications. This technique renders the malicious extension indistinguishable from a legitimate installation, despite the absence of user authorization—a known but infrequently observed approach in active malware.
KREMLIN uses a documented technique rarely observed in malware: it manually copies the extension into the browser's profile directories and registers it in the Secure Preferences file. Because Chromium protects these entries with cryptographic integrity checks, the malware must retrieve the required keys and regenerate the associated HMACs and encrypted hashes.
Elastic Security Labs
Once activated, the extension operates under the guise of AVSync and executes multiple data-harvesting functions:
- Harvests cookies, local storage, and session storage data
- Records keystrokes entered into web forms, including login credentials
- Captures screen images and page markup
- Logs open browser tabs and navigation history
- Monitors HTTP request payloads and header information
- Inserts malicious HTML content into visited websites
- Reroutes user clicks toward attacker-controlled resources
- Accepts instructions via WebSocket protocol
Beyond the extension component, KREMLIN functions as an information-stealing utility capable of compressing and transmitting browser databases, stored credentials, extension inventories, and App-Bound cryptographic keys required for decrypting protected information.
Campaign disruption and infrastructure analysis
Elastic Security Labs determined that KREMLIN operations leverage Ethereum smart contracts as payload delivery mechanisms and exploit the Internet Archive platform to distribute malicious content disguised within JPEG files. Recent iterations introduced the REMCOS remote access tool, replacing earlier deployments of Pulsar RAT—a transition researchers attribute to REMCOS offering expanded functionality.
Through infrastructure correlation and code analysis, researchers identified the Ethereum wallet responsible for deploying and modifying the smart contracts. The wallet processed approximately 20,800 USDT (Tether) in inbound transfers and 19,000 USDT in outbound transfers. Elastic confirmed 1,515 compromised systems, predominantly distributed across Brazil.
Elastic Security Labs disrupted the active KREMLIN campaign by registering a domain that the malware queries as an anti-sandbox verification mechanism, triggering false positives that prevented infection on otherwise vulnerable systems. The researchers have published comprehensive documentation of KREMLIN attack methodologies, techniques, and a collection of indicators of compromise.