GoKawiilA banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.
Researchers at Elastic Security Labs found that the malicious extensions bypass Chromium’s integrity mechanisms and load in browsers as if they had been approved by the user.
The infection chain starts after the target user opens a JavaScript file disguised as a bank receipt, invoice, payment record, or business document.
After passing anti-sandbox checks, the file triggers a fake error while simultaneously downloading Node.js, establishing persistence through a scheduled task, and retrieving the additional payload location from an Ethereum smart contract.
Despite the name, KREMLIN is linked to a Brazilian operation responsible for at least seven campaigns since May 2025 that use lures impersonating 12 banks.
Installing Chrome and Edge add-ons
A standout feature of KREMLIN is its capability to install extensions on Chrome and Edge browsers without asking the user to approve them.
It waits for the browser to close or terminates it when it detects idle status, and then copies the extension into the app’s profile directories. Next, it enables developer mode and adds the extension to Chromium’s Secure Preferences.
To hide its activity, the malware uses the encryption keys the browser uses to protect sensitive data and then recreates the integrity checks Chrome uses to detect changes in browser preferences.
This makes the malicious extension appear valid to the browser despite never being approved by the user, a documented but rarely used technique according to the researchers.
... continue reading