MalwarePublished 16 Sep 2026

Malware bypasses browser checks to force install Chrome, Edge extensions

Source Bleeping Computer

malware

Description

A banking malware operation active since mid-2025 uses a toolkit called KREMLIN to forcibly install malicious Chrome and Edge browser extensions. These extensions are designed to steal credentials, session tokens, and other sensitive user data. The malware bypasses normal browser security checks to achieve installation.

Impact

The malware enables attackers to steal sensitive data including login credentials and session tokens from infected users, potentially leading to unauthorized access to banking and other online accounts. This compromises user privacy and security, and may result in financial theft or fraud.

Defensive guidance

No specific patch or official fix is indicated for this malware operation. Users should ensure their browsers and security software are up to date and exercise caution when installing browser extensions. Monitoring for suspicious extensions and removing unauthorized ones can help mitigate risk. Organizations should educate users about the risks of unsolicited extension installations and consider endpoint protection solutions that detect such malware behaviors.

References

bleepingcomputer.com/news/security/malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Sep 2026, 19:01 UTC

References

Community reviews

Related threats