This threat involves a banking malware campaign utilizing the KREMLIN toolkit to install malicious extensions on Chrome and Edge browsers without user consent or detection by standard browser security mechanisms. The extensions capture sensitive information such as credentials and session tokens, facilitating credential theft and potential account compromise. The operation has been active since mid-2025, indicating ongoing targeting of users through browser extension abuse.

The malware enables attackers to steal sensitive data including login credentials and session tokens from infected users, potentially leading to unauthorized access to banking and other online accounts. This compromises user privacy and security, and may result in financial theft or fraud.

No specific patch or official fix is indicated for this malware operation. Users should ensure their browsers and security software are up to date and exercise caution when installing browser extensions. Monitoring for suspicious extensions and removing unauthorized ones can help mitigate risk. Organizations should educate users about the risks of unsolicited extension installations and consider endpoint protection solutions that detect such malware behaviors.