1,515 infected systems — almost all in Brazil — is the concrete toll Elastic Security Labs reported after tracking a mid‑2025 banking malware operation that forces malicious Chrome and Edge extensions into victims’ browsers without their consent.
KREMLIN: a toolkit, not a Kremlin
Elastic Security Labs identified the toolkit as KREMLIN. Despite the name, the researchers tied KREMLIN to a Brazilian operation that ran at least seven campaigns since May 2025 using lures impersonating 12 banks. The toolkit functions both as an info‑stealer and as a delivery mechanism for browser extensions that harvest credentials, session tokens, and other sensitive material.
How KREMLIN forces Chrome and Edge extensions into profiles
The standout technical feature in the KREMLIN toolkit is its ability to install extensions on Chromium‑based browsers without user approval. According to Elastic, the infection chain begins when a target opens a JavaScript file disguised as a bank receipt, invoice, payment record, or business document. After passing anti‑sandbox checks, the file triggers a faux error while downloading Node.js, creating persistence through a scheduled task, and obtaining additional payload locations from an Ethereum smart contract.
Once the payloads arrive, KREMLIN waits for the browser to close — or it terminates the process when it detects idle status — then copies the extension into the browser’s profile directories. It enables developer mode and registers the extension in Chromium’s Secure Preferences. Because Chromium validates Secure Preferences using cryptographic integrity checks, the malware retrieves the browser’s encryption keys and regenerates the HMACs and encrypted hashes so the browser treats the extension as valid.
“KREMLIN uses a documented technique rarely observed in malware: it manually copies the extension into the browser's profile directories and registers it in the Secure Preferences file,” Elastic explains. The firm adds that replicating the preference integrity protections is necessary for the extension to appear legitimate despite never being approved by the user.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAVSync: what the malicious extension does
The extension deployed by KREMLIN masquerades as AVSync. Once active, Elastic reports, it performs a broad set of espionage and manipulation actions:
- Steals cookies, local storage, and session storage
- Keylogs text entered into forms, including passwords
- Captures screenshots and page source
- Enumerates open tabs and browsing history
- Intercepts HTTP request bodies and headers
- Injects attacker‑controlled HTML into websites
- Redirects clicks to attacker‑selected destinations
- Receives commands through a WebSocket connection
Beyond the extension, KREMLIN itself can archive and exfiltrate browser databases, cookies, installed extensions, and the App‑Bound cryptographic keys needed to decrypt protected data.
Infrastructure: Ethereum smart contracts, Internet Archive, REMCOS and Pulsar
Elastic’s researchers documented two notable infrastructure tactics. First, the attackers use Ethereum smart contracts as dead‑drop resolvers: the loader retrieves additional payload locations from a contract maintained by an identifiable wallet. Elastic connected the wallet to about 20,800 USDT and 19,000 USDT in incoming and outgoing transfers, respectively.
Second, the actors abused the Internet Archive to host payloads covertly inside JPEG images. The operation has also shifted remote access tooling over time: past campaigns used the Pulsar RAT, while more recent activity deployed the REMCOS remote access tool, a change the researchers say was likely because REMCOS offered greater features.
Campaign scale and disruption
Elastic confirmed 1,515 infected systems, with almost all victims in Brazil. Through infrastructure analysis and artifact linkage the researchers traced the smart contract wallet and other campaign elements. To disrupt the active campaign, Elastic registered a domain the malware used as an anti‑sandbox canary; the presence of that domain caused the loader to abort on systems that would otherwise qualify for infection.
How technologists, enterprises, and end users should react
Technologists and security teams will note two operational risks: (1) attackers can bypass Chromium’s user‑consent pathways by manipulating profile files and browser keys; and (2) infrastructure choices such as Ethereum smart contracts and public archives create resilient, hard‑to‑takedown channels. Enterprise defenders should watch for unexpected developer‑mode extensions in profile directories and protect access to browser encryption material.
Enterprises and procurement leaders should inventory browser policy controls that prevent local modifications to Secure Preferences, and verify scheduled tasks and local Node.js installations that the loader uses to establish persistence.
End users should be aware that opening seemingly benign JavaScript attachments labeled as receipts or invoices can trigger complex loader chains that install powerful data‑stealing extensions without prompts.
Elastic Security Labs’ technical breakdown and indicators of compromise provide concrete artifacts defenders can use to detect and disrupt KREMLIN activity; the firm’s registration of the canary domain demonstrates how operational countermeasures can blunt a campaign in flight. The remaining question the facts leave is whether the operators will change their preference‑integrity approach or their distribution channels now that researchers have exposed and partially neutered this toolkit.
Original reporting: https://www.bleepingcomputer.com/news/security/malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions/
