KREMLIN banking malware force-installs malicious Chrome and Edge extensions to steal logins and session data

Updated: 2026.09.16 1M ago 1 sources

Malware Social Engineering & Phishing Scams & Fraud

A Brazil-focused banking malware operation has been secretly installing malicious extensions into Google Chrome and Microsoft Edge so they can steal passwords, cookies, and active login sessions. Elastic says the KREMLIN toolkit, active since mid-2025, bypasses Chromium integrity protections by writing directly into Secure Preferences and recomputing the browser’s cryptographic checks, making the add-ons appear user-approved. The campaign starts from JavaScript files disguised as receipts, invoices, or bank documents, uses Ethereum smart contracts as dead-drop resolvers, and has at least 1,515 confirmed infections, almost all in Brazil.

Why it matters: This gives attackers a way to quietly hijack banking and web sessions even when users never approved a browser extension. Affected organizations and users should hunt for unauthorized Chrome or Edge extensions, review scheduled-task persistence, and treat banking-document lures and stolen browser sessions as an active risk.

Sources

Malware bypasses browser checks to force install Chrome, Edge extensions

Bill Toulas 2026.09.16 100% relevant

This article establishes a distinct malware campaign centered on the KREMLIN toolkit’s forced installation of malicious Chromium extensions, with concrete infection chain, capability, and scope details not reflected in the tracked story list.