GoKawiilKREMLIN toolkit forces fake Chrome and Edge extensions onto Brazilian banking targets
Elastic Security Labs uncovered a malware toolkit called KREMLIN, active since mid-2025, that tricks victims into opening fake invoice or receipt files to install malicious Chrome and Edge extensions without any user approval. The toolkit recreates Chromium's cryptographic integrity checks so the browser treats the rogue extension as legitimate, then harvests login credentials, session tokens and other sensitive data. Elastic ties the operation to a Brazilian group that has run at least seven campaigns impersonating 12 banks since May.
GoKawiil's interpretation of the reporting above, not reported fact.
This technique undermines a core browser safeguard meant to stop unauthorized extensions from running, meaning users could be compromised even while believing their extension list is clean and approved. Because the malware also uses Node.js persistence and an Ethereum smart contract to fetch payloads, it shows attackers blending legitimate developer tools and blockchain infrastructure to dodge detection, a pattern likely to spread beyond banking fraud.
- KREMLIN bypasses Chromium's cryptographic checks to install extensions without user consent.
- The malware spreads via fake bank documents and uses Node.js and Ethereum smart contracts for persistence and payload delivery.
- Linked to a Brazilian operation impersonating 12 banks across seven campaigns since May 2025.
YubiKey 5C NFC Security Key — With banking malware now hijacking browsers to steal credentials and session tokens, hardware-based authentication is one of the few defenses that phishing and extension-based attacks can't bypass. A YubiKey adds a physical verification step to your logins, so even if malware steals your password, it can't complete authentication without the key in hand. It's a practical, one-time investment in protecting sensitive banking and email accounts from exactly this kind of threat.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-16
Published there as: “Malware bypasses browser checks to force install Chrome, Edge extensions”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.