KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions

A Brazilian banking malware operation, dubbed KREMLIN, that can silently implant malicious extensions in Google Chrome and Microsoft Edge, bypassing Chromium’s built-in integrity protections to steal credentials, cookies, and active banking sessions.

Despite its name, the KREMLIN toolkit shows no apparent Russian connection. The campaign relies on Portuguese-language artifacts, lures impersonating 12 Brazilian banks, and infrastructure activity aligned with São Paulo business hours.

The attack begins with a victim manually launching a JavaScript file disguised as a banking document, invoice, or corporate file.

The loader displays a deceptive error message while quietly assessing the environment for sandboxing or virtual-machine indicators.

If the host passes those checks, it downloads additional stages, establishes scheduled-task persistence, and retrieves payload locations from an Ethereum smart contract.

One recent persistence mechanism registers a scheduled task named MicrosoftNodeRuntimeUpdater, configured to launch Node.js after user logon.

KREMLIN then uses a legitimate SentinelOne executable, SentinelMemoryScanner.exe, to sideload a malicious DLL masquerading as SentinelAgentCore.dll.

This DLL-side-loading approach allows the malware to execute under the cover of a trusted security-product binary.

Elastic Security Labs said in a report shared with GBhackers, which tracks the activity as REF9334, said the operation has been active since at least May 2025 and spans seven campaigns over 15 months.

KREMLIN Banking Malware

The most technically significant component is KREMLIN’s browser-extension installer.

Rather than depend on a victim to approve an extension or install one through the Chrome Web Store, the malware manipulates each target browser profile’s Secure Preferences file.

The sandbox-detection heuristic consists of two checks. First, it counts the files on the user’s desktop. Second, it uses a WMI query to count the processes running on the machine.

It enables developer mode, inserts a malicious extension registration, and regenerates the cryptographic values Chromium uses to detect unauthorized preference changes.

The technique is related to the publicly documented “Phantom Extension” method, which demonstrates that an actor with local file-write access can implant arbitrary extensions by modifying browser preference files and calculating the required Message Authentication Codes.

The ZIP archive is then encrypted with RC4 through the undocumented SystemFunction032 API, using the SHA-256 digest of the plaintext archive as the encryption key. 

Malicious extensions are especially dangerous because they can access browser APIs, read cookies and storage, alter web content, intercept requests, and interact with tabs that hold authenticated cloud or banking sessions.

KREMLIN goes further by recovering Chrome and Edge encryption material, including the newer App-Bound OSCrypt key.

It launches the browser under a debugger, extracts key material from browser memory, and uses it to create integrity values compatible with newer Chromium releases.

The result is an extension that the browser loads as if it were legitimately installed by the user.

Once active, the extension masquerades as AVSync and requests permissions for tabs, cookies, storage, and the webRequest API.

Its capabilities include harvesting cookies, sessionStorage, and localStorage; capturing screenshots; enumerating tabs; extracting page HTML; logging data entered into web forms; intercepting request bodies or headers; and injecting attacker-controlled HTML into targeted pages.

Such access could enable account takeover even where banks use multifactor authentication, because stolen session tokens may represent an already authenticated user session.

KREMLIN’s command-and-control architecture is equally resilient.

The malware uses an Ethereum smart contract at 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b as a dead-drop resolver, enabling operators to update payload-hosting domains and C2 endpoints without updating the malware itself.

Recent “Set Config” transactions on the contract show the infrastructure remained actively maintained.

Elastic reported disrupting more than 1,500 infections through a network canary domain, while researchers assess Brazil as the principal target.

Defenders should hunt for unexpected changes to Chrome and Edge preference files, unauthorized developer-mode activation, unknown extensions in user profiles, suspicious browser debugging activity, and WebSocket traffic originating from browser extension processes.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.