The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

The KREMLIN toolkit is a Brazilian banking malware operation active since May 2025, targeting Brazilian financial institutions via malicious Chrome browser extensions. It manipulates Chromium's integrity checks by forging Secure Preferences and HMACs to evade detection. The malware intercepts credentials, session tokens, and sensitive banking data through keylogging and request interception. The operation uses Ethereum smart contracts for dynamic command and control configuration and has evolved through multiple campaigns delivering different remote access trojans. Over 1,500 infections have been temporarily disrupted, with the vast majority of victims located in Brazil.

• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27
• Inside SiriusQT: A Seriously Skilled RATMalware2026-10-22
• 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet CredentialsCampaign2026-10-08
• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-09-25
• Malicious Twitch Browser Extension Exposes 30,000 Users' OAuth Tokens to Russian Bot ServiceCampaign2026-09-11