Table of Contents
Key Takeaway
- 🕸️ New player, old door: Elastic Security Labs exposed KREMLIN banking malware — a Brazilian operation, active since May 2025, that steals bank logins and session tokens through malicious Chrome and Edge extensions.
- 🧬 The trick that changes the rules: KREMLIN forges Chrome’s own integrity records — regenerating the Secure Preferences HMACs — so the browser treats a malicious extension as a legitimate one.
- 🛡️ The takedown shield: The operation hides its command-and-control inside Ethereum smart contracts, so there is no fixed server to seize — blocking domains is not enough.
- 🔎 The counter: A six-check defense — extension audit, browser integrity verification, session hygiene, passkeys, device health, and banking-alert discipline — stops this class of attack on any computer you control.
The most dangerous banking malware of the season does not break into your bank. It gets your browser to vouch for it. In a technical report published this month, Elastic Security Labs documented KREMLIN, a previously undocumented operation tracked as REF9334 that has been impersonating a dozen Brazilian banks since at least May 2025. The malware’s defining move is not the credential theft — that part is routine. It is the forgery: KREMLIN manipulates Chrome’s Secure Preferences file, regenerates the integrity hashes Chromium uses to detect tampering, and installs a malicious browser extension that Chrome itself then treats as legitimate. The loot is credentials and, more importantly, live session tokens — the tickets that let criminals walk into a banking session without ever passing a password prompt again.
Why a Banking Trojan Moved Into the Browser
For two decades, the standard playbook against banking trojans was network-level: intercept traffic, overlay fake login forms, scrape keystrokes. That playbook is dying, and KREMLIN shows what replaced it. Banks encrypt their traffic, harden their apps, and deploy device-bound fraud detection — but none of that protects the browser extension sitting inside the user’s own profile, installed with Chromium’s own blessing. The browser is now the most trusted process on a bank customer’s computer, and trust is precisely what this malware weaponizes.
The economics make the shift inevitable. Stealing a password is a race against the bank’s fraud systems; stealing a live session is not. A session token is already inside the authenticated perimeter — no second login, no one-time-password challenge, no step-up verification unless the bank triggers it. This is why the extension stage of KREMLIN exists at all: the JavaScript loader, the C++ installer, and the sandbox checks are all in service of getting one malicious extension silently into Chrome or Edge. Elastic’s researchers, Cyril François and Andrew Pease, summarized the payload plainly: “The KREMLIN malware ecosystem employs multi-stage JavaScript loaders, custom C++ installers, and malicious browser extensions to steal credentials, session tokens, and sensitive data.”
The scale ambition is modest by malware-industry standards but meaningful in shape. KREMLIN’s lures impersonate roughly a dozen Brazilian banks, arriving as what looks like a banking document, invoice, or company file that the victim opens manually. That targeting profile — real bank names, real document lures, manual execution — is a template, not a one-off. The same KREMLIN banking malware architecture points at any country’s banking ecosystem without changing a line of the core toolkit.
How KREMLIN Forges Chrome’s Integrity Checks
Chromium has a defense mechanism most users have never heard of: the Secure Preferences file, protected by HMACs keyed to the machine, records which extensions are legitimately installed. If something adds an extension out-of-band — malware writing directly to the profile — the hash mismatch trips Chrome’s tamper detection and the extension is stripped. KREMLIN’s answer is not to evade the check but to satisfy it. Using two publicly documented techniques, Phantom Extension and GhostChrome-X, the malware enables Chrome’s developer mode, edits the Secure Preferences file, and regenerates the “protection.macs” metadata so the forged entries carry valid hashes. Chrome then re-derives its trust from the very file the malware just rewrote — the forgery at the heart of the KREMLIN banking malware design.
The delivery chain shows how much engineering discipline modern banking malware now carries. Stage one is a JavaScript file disguised as a banking or invoice document, manually opened by the victim. The multi-stage loader refuses to run inside a sandbox or virtual machine — it checks the process list and hardware fingerprints, requiring at least 2 CPUs and more than 3 GB of RAM before proceeding, and aborts if a known analysis process appears. Stage two establishes persistence through a scheduled task, fetches download locations from an Ethereum smart contract, and pulls binaries from URLs served by that contract. Stage three is the C++ installer, which sideloads its unsigned payload by abusing a genuine SentinelOne binary — the payload impersonates “SentinelAgentCore.dll,” borrowing the identity of a security product to look like infrastructure rather than an intruder. The Hacker News’s coverage of the report confirms the same chain straight from the researchers’ write-up.
The final KREMLIN banking malware payload registers itself as a browser extension named “AVSync System Inc.” with the ID ndpbidppejfanjbhfgjlohfanbfbklff, version 1.0.0. Before installing, the malware consults the smart contract for the current version and only downloads the extension if it is missing or outdated — a self-updating supply chain. Once installed, the extension harvests credentials and session tokens from the sites the victim actually visits, which is what makes it banking malware rather than a generic infostealer: it watches the places where money moves.
For anyone auditing their own machine for KREMLIN banking malware, the practical detection points are concrete. Check the installed extension list in Chrome and Edge against what you actually installed, in both browsers, in every profile. Treat any extension you cannot remember adding — especially one with a corporate-sounding name like a system utility — as hostile until proven otherwise. Chromium’s developer-mode prompt appearing without your action is another tell: the forgery process needs developer mode enabled, which is itself an abnormal state for an ordinary user’s browser.
The Smart Contract That Makes the Kill Chain Untouchable
The component that elevates KREMLIN from clever to structurally important is its command-and-control. Traditional malware points at fixed domains; defenders block the domain, sinkhole the server, and the operation dies. KREMLIN instead uses an Ethereum smart contract as a dead drop resolver — the malware reads the blockchain to learn where its C2 endpoints and payload hosting currently live, and the operator updates the contract to move infrastructure at will. The domains observed so far, volmira[.]site and zaviro[.]online, are disposable addresses for infrastructure that has no permanent address at all.
This is the first documented use of blockchain dead drops at this maturity in the consumer banking space, and it changes the defense math. You cannot take down what has no fixed location; you can only block what you can see. Network-level defenses — DNS filtering, proxy blocks, sinkholing — remain necessary but are now provably insufficient against this design. The KREMLIN banking malware will always find its next instruction, because the ledger is public and immutable by design. The same properties that make Ethereum resistant to censorship make it resistant to takedowns.
The implication for security teams is uncomfortable but clarifying: the perimeter defense era of malware response assumes the attacker needs reachable infrastructure. Blockchain-resolver malware does not need to be reachable in advance. Detection has to move to the endpoint — the forged extension, the tampered Secure Preferences file, the borrowed DLL — because the network is no longer a reliable place to catch this class of operation.
What the SentinelOne Borrowing Tells Us About Trust
The most instructive detail in the report is almost a footnote: the KREMLIN banking malware sideloads its unsigned payload through a legitimate SentinelOne binary, and its malicious module impersonates “SentinelAgentCore.dll.” The malware does not disable the security product. It borrows the product’s identity to look like part of the security stack itself.
That is the threat model of 2026 in miniature. Attackers have stopped fighting the trust infrastructure — app stores, browser integrity checks, security agents, code signatures — and started forging tickets to it. A forged HMAC turns Chrome’s tamper detection into the malware’s notarization. A borrowed security vendor’s binary name turns endpoint telemetry into camouflage. Every layer that assumes “signed means safe” or “security-named means security” is now an attack surface.
It also explains why this KREMLIN banking malware operation survived for over a year before a public report. Nothing about it looks like classic malware from the outside: no obvious network beacon to a fixed domain, no unsigned driver, no process named suspiciously. A machine infected in May 2025 could have passed routine antivirus checks for months while its owner banked normally — with a third party holding copies of every credential and session token that passed through Chrome.
What the KREMLIN Banking Malware Playbook Means for Professionals
KREMLIN banking malware targeted Brazilian banks, but the architecture is jurisdiction-free, and the populations most exposed to browser-based banking are exactly the ones this site serves: professionals who manage money across borders, log into financial portals from laptops they also use for everything else, and cannot afford either a drained account or a week of fraud disputes. The playbook converts the report into a defense posture any professional can implement in under an hour.
Check one — audit every extension, everywhere. Open chrome://extensions and edge://extensions on every machine and profile you use. Remove anything you did not deliberately install, and anything you cannot trace to an intentional decision. Pay special attention to utilities with generic corporate names — “AVSync System Inc.” was chosen to look like plumbing, not like a product anyone would search for.
Check two — verify what has integrity, then lock the door. The Phantom Extension technique requires developer mode; ordinary users should never leave it on. If developer mode is enabled in your browser and you did not enable it, treat the profile as compromised: sign out of every site, clear browsing data, and remove extensions before signing back in.
Check three — shorten your sessions. Session tokens are the prize. Log out of banking portals when you finish rather than leaving tabs alive; every closed session is a token the malware cannot harvest. Where your bank offers session timeout controls, use them. A stolen password is recoverable; a stolen live session is money walking out the door.
Check three-and-a-half, in priority order — switch to passkeys. Credential phishing dies against FIDO2 passkeys, and several major banks now support them. Passkeys do not fix a live session hijack after you are already logged in, but they remove the credential-theft half of KREMLIN’s business model and blunt the initial capture. This is the same logic we laid out in our guide to passkey security against 39 documented attack patterns: phishing-resistant credentials reduce the attack surface faster than any single antivirus product.
Check four — separate money from browsing. A dedicated browser profile — or a dedicated device, even an old phone — used only for banking, with no extensions installed, shrinks the attack surface to nearly zero. The extension KREMLIN installs only sees what the infected profile sees. Keep the profile where money moves isolated from the profile where downloads happen, and the multi-stage loader has nothing to harvest.
Check five — watch for the tells and act on them. Browser prompts you did not trigger, an unfamiliar extension named like a system service, banking app logouts you did not cause — these are the visible edges of this class of attack. Report unauthorized bank access immediately; in most jurisdictions, prompt reporting is the difference between a reversed transaction and a permanent loss. And treat “verify the sender” hygiene as table stakes: the lure that starts this chain is a document the victim chose to open, which is the same first step as the fake installer scams we documented this month.
None of these six checks requires new software, a security team, or money. They require the recognition that the browser — the most trusted process on the machine — is now the primary battlefield for financial theft, and that trust must be audited like any other asset. And because stolen credentials from any campaign end up in shared leak databases, run your addresses through the data breach checker guide we published this month to see whether your accounts are already in circulation.
Frequently Asked Questions About KREMLIN Banking Malware
What is KREMLIN banking malware?
KREMLIN banking malware is a previously undocumented operation tracked by Elastic Security Labs as REF9334, active since at least May 2025. It impersonates about a dozen Brazilian banks with document lures, then installs malicious extensions in Chrome and Edge to steal banking credentials and session tokens.
How does KREMLIN bypass Chrome’s security?
It edits Chrome’s Secure Preferences file and regenerates the integrity HMACs that Chromium uses to detect unauthorized changes — using publicly documented techniques called Phantom Extension and GhostChrome-X. After the forgery, Chrome treats the malicious extension as a legitimately installed one.
Why does KREMLIN use Ethereum smart contracts?
The malware stores its command-and-control locations inside an Ethereum smart contract as a dead drop resolver. The malware reads the blockchain to find its current C2 domains and payload URLs, and the operator updates the contract to move infrastructure — so there is no fixed server for defenders to seize or block permanently.
Does KREMLIN banking malware affect users outside Brazil?
The documented campaign impersonates Brazilian banks, but the architecture — forged browser extensions, blockchain-based infrastructure, security-tool impersonation — is a template that can be retargeted at any country’s banking system. The defensive checklist applies to any user of Chrome or Edge anywhere.
Can antivirus software stop KREMLIN?
Partially, at best. The malware’s installer abuses a legitimate SentinelOne binary to sideload its payload and impersonates “SentinelAgentCore.dll,” and its sandbox checks abort execution on analysis machines. Extension-list audits, developer-mode hygiene, session hygiene, and passkeys are the controls that address the parts antivirus does not see.
What should I do first if I suspect this malware on my computer?
Sign out of all banking and financial sessions, inspect your extension lists in every browser profile, remove anything unfamiliar, disable developer mode, clear browsing data, and run a full scan with an updated security product. Then change banking passwords and enable the strongest available login method — preferably passkeys — before signing back in.
Financial Disclaimer
This article is for informational and educational purposes only and does not constitute professional cybersecurity or financial advice. Readers should assess their own security posture and consult qualified security professionals for their specific environment.
