KREMLIN Malware Hijacks Chrome and Edge

A bank customer opens what looks like a routine invoice or company document, double-clicks it, and triggers a JavaScript loader. Within minutes, a toolkit called KREMLIN has quietly taken root, installing a malicious browser extension across Google Chrome and Microsoft Edge and harvesting credentials, session tokens, and sensitive data. Elastic Security Labs, which tracks the activity under the moniker REF9334, said the operation has been active since at least May 2025 and targets users through lures that impersonate a dozen Brazilian banks.

The research, attributed to security researchers Cyril François and Andrew Pease, describes an ecosystem built from multi-stage JavaScript loaders, custom C++ installers, and malicious browser extensions. According to the researchers, the malicious extensions bypass Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes.

A banking lure starts the chain

The entry point is a JavaScript file disguised as a banking document, invoice, or company file. It is not delivered through a drive-by exploit; the victim has to execute it manually. Once that happens, the script launches a multi-stage loader that refuses to run inside a sandbox or virtual machine. If the environment passes those checks, the loader downloads and installs additional payloads before handing control to the next stage.

That second stage does four specific things: it establishes persistence through a scheduled task, retrieves download locations from an Ethereum smart contract, downloads binaries from those locations, and executes the third stage. The payload URLs serve three programs — a malicious browser extension installer payload, a .NET PE Injector, and SentinelMemoryScanner.exe, a legitimate binary associated with SentinelOne that is abused for DLL sideloading.

The C++ installer uses that legitimate SentinelOne binary to sideload its unsigned main payload, which masquerades as SentinelAgentCore.dll. Once running, the DLL repeats the sandbox and virtual machine evasion checks performed by the JavaScript loader, scanning the list of running processes and examining machine hardware properties such as the number of CPUs and the amount of RAM. If a running process matches an entry in its hard-coded list — or if the system does not have at least 2 CPUs and exceed 3 GB of RAM — the malware terminates.

Ethereum contracts as dead drops

A defining part of the operation is the use of blockchain-based infrastructure to keep the threat actor's command-and-control endpoints alive. Elastic said the group leverages Ethereum smart contracts as dead drop resolvers, dynamically updating C2 endpoints and payload hosting locations so that they cannot be easily disrupted.

KREMLIN reaches out to the same smart contract to fetch two domains, volmira[.]site and zaviro[.]online. It queries the former to obtain the browser extension version ("1.0.0") and its ID ("ndpbidppejfanjbhfgjlohfanbfbklff"). The extension identifies itself as "AVSync System Inc."

Before downloading the extension archive, the malware checks whether the extension is already installed and, if it is, compares the installed version against the version reported by the server. It downloads the extension only when no local installation exists or when the versions differ, then pulls the Chrome extension as a ZIP archive.

Phantom Extension and GhostChrome-X in play

To install the extension on Chromium-based browsers, KREMLIN relies on publicly documented integrity bypass techniques known as Phantom Extension and GhostChrome-X, avoiding the Secure Preferences protection mechanism. The approach modifies the Secure Preferences file, enables Chrome's developer mode, and updates the "protection.macs" JSON object with forged metadata so the malicious extension is registered.

That same technique was adopted by the China-linked APT31 actor in a late August 2026 campaign that used the BlueMoon exploit kit, comprising now-patched Chrome and Windows zero-days, to install a credential-stealing browser extension codenamed GemStone.

Once the extension is installed, KREMLIN begins harvesting and exfiltrating browser data for each profile to its C2 server at luizestrelhashapr[.]online:443. Before doing so, it requests extensive access to browser tabs, cookies, storage, and the webRequest API. It also generates a unique victim identifier that is stored in the browser's storage and included in the C2 communications.

What the extension can do

After establishing a WebSocket channel with the C2 server, the extension supports a defined set of commands:

• Take screenshots of the selected or active tab and upload a compressed image
• Enumerate tabs, domains, and active state, and upload the list
• Steal cookies, sessionStorage, and localStorage from the selected or active tab
• Collect up to 1,000 history entries from the previous 15 days (likely to fail because the extension manifest lacks the history permission)
• Extract and upload the full HTML source of the selected or active page
• Download attacker-controlled HTML
• Refresh configuration

In addition to WebSocket, the extension periodically polls a "/google_api/" endpoint through requests that masquerade as CSS file fetches. Each path maps to a specific command. The file 108766d0.css uploads cookies and storage; 41f7b187.css uploads tab IDs, domains, and active-tab state; b83fa72d.css uploads compressed browser history from the previous 15 days; 0f51ad2f.css uploads a compressed JPEG screenshot along with the page URL and client ID; e4cce14e.css uploads compressed full-page HTML along with the page URL and client ID; 6c0c92f6.css uploads intercepted requests; 81d47cb6.css fetches targeting configuration containing a list of domains and HTTP interception rules; and a98cb43d.css fetches redirection rules containing destination URLs.

Timeline points to a shifting toolkit

Elastic assesses that the actors behind KREMLIN have been active since at least May 2025, a period that includes installing malicious browser extensions and distributing off-the-shelf Trojans such as Pulsar RAT and Remcos RAT. The move to Ethereum smart contracts is said to have occurred on May 19, 2026. In total, the group has been attributed to seven distinct campaigns since June 16, 2025.

The researchers also described an anti-sandbox mechanism that performs a network canary check by attempting to download a page from an unregistered domain. If the malware receives a valid response, that likely indicates a sandbox simulating network connectivity, and the malware deliberately crashes to avoid analysis.

"The KREMLIN malware ecosystem employs multi-stage JavaScript loaders, custom C++ installers, and malicious browser extensions to steal credentials, session tokens, and sensitive data," security researchers Cyril François and Andrew Pease said in a technical report shared with The Hacker News.

— Cyril François and Andrew Pease, security researchers at Elastic Security Labs

Elastic said it registered the network canary domain and identified 1,515 infected systems attempting to check in. More than 98% of those systems are geolocated to Brazil.

"So while these systems are still infected with the final component of KREMLIN, this has temporarily degraded and manipulated the campaign's defense mechanisms and could provide defenders with additional time to identify and remediate infected endpoints," Elastic said.

Session tokens become the prize

The extension is not just after passwords. Its ability to pull cookies, sessionStorage, and localStorage from the selected or active tab means it can capture live session tokens — the credentials that keep a user logged in without re-entering a password. For banking targets, that is often enough to move money or access account data without triggering a fresh authentication prompt.

The extension also collects tab lists, domains, active-tab state, and even full-page HTML, giving the operators a picture of what the victim is viewing and where they are logged in. The targeting configuration fetched from the C2 includes domain lists and HTTP interception rules, while the redirection rules include destination URLs, suggesting the malware can steer traffic or inject content based on what the victim visits.

For each browser profile, the extension operates separately, and the victim identifier stored in browser storage allows the attackers to track infected machines across sessions. The use of a WebSocket channel means commands can flow in near real time, rather than waiting on a polling interval.

Why the blockchain angle matters

Using Ethereum smart contracts as dead drop resolvers gives the operators a way to change their infrastructure without updating the malware. The malware only needs to read the contract to learn where to fetch its next payload or which domain to contact. Because the blockchain is public and decentralized, takedown efforts aimed at a single server or domain do not necessarily sever the chain.

This is not a new idea in malware design, but its appearance in a Brazilian banking campaign points to a broader adoption of resilient hosting techniques. The same contract can hold current and future endpoints, and updates are written to a ledger that the operators control.

The two domains, volmira[.]site and zaviro[.]online, are retrieved from the contract. The first is queried for the extension version and ID, while the C2 traffic goes to luizestrelhashapr[.]online on port 443.

Detection and response considerations

The network canary check is one of the more unusual details in the report. By registering the canary domain, Elastic said it was able to observe 1,515 infected systems checking in — and more than 98% of them are in Brazil. That gives defenders a rare view into the campaign's reach, even as the malware's other evasion layers remain in place.

Because the malware relies on a scheduled task for persistence and on a sideloaded DLL masquerading as SentinelAgentCore.dll, endpoint detection efforts may need to look at process lineage and loaded modules rather than just file names. The use of a legitimate SentinelOne binary for DLL sideloading is a reminder that signed binaries can be repurposed when an attacker gains write access to the right directory.

Browser extension abuse also complicates detection. The extension registers itself through a manipulation of Secure Preferences, which means it may appear in the browser's extension list only after the integrity bypass has been applied. Users who notice unexpected extensions — particularly one named "AVSync System Inc." — should treat it as a potential indicator of compromise.

Elastic's report notes that the extension requests permissions for tabs, cookies, storage, and the webRequest API. Those are broad permissions that, in a legitimate extension, might be justified for a sync or productivity tool. In this case, they support the collection of browser data across profiles.

The bottom line for defenders

The KREMLIN operation shows how a banking lure can escalate into a persistent browser-level threat that survives password changes and captures session tokens. For businesses, the practical implication is that endpoint protection needs to cover browser extension installation and the manipulation of Chromium preference files, not just executable downloads. For consumers, especially those in Brazil, the risk starts with executing a document received through a banking or invoice lure — the kind of file that looks routine until it isn't.

Elastic's registration of the canary domain has already disrupted part of the campaign's defenses, but the underlying toolkit remains in the wild, and more than 98% of the observed infected systems are geolocated to Brazil. That concentration suggests the campaign is deliberately targeted rather than opportunistic, which could mean the operators are still active and refining their approach. For now, the most concrete takeaway is that a malicious browser extension can be as dangerous as a traditional banking trojan — and that the techniques used to install it are already circulating in other campaigns.