The KREMLIN malware, active since mid-2025, bypasses browser integrity checks to install malicious extensions in Chrome and Edge without user consent. Researchers at Elastic Security Labs report that the malware typically initiates through disguised JavaScript files mimicking business documents like invoices or bank receipts.
Once the malware passes anti-sandbox checks, it downloads Node.js and establishes persistence via scheduled tasks. It retrieves payload download addresses from Ethereum smart contracts. The malware is linked to a Brazilian group that has conducted at least 7 campaigns since May 2025, targeting at least 12 banks.
KREMLIN forces extension installation by terminating browser processes or waiting for idle states to copy files into user profile directories. It enables developer mode and modifies Chromium Secure Preferences. By reconstructing integrity verification mechanisms, it hides unauthorized modifications from the browser.
The installed extension, disguised as AVSync, captures screenshots, page source code, browsing history, and open tabs. It intercepts HTTP requests, injects malicious HTML, and redirects user clicks. Elastic Security Labs disrupted the operation by registering domains used as anti-sandbox probes.
