BleepingComputer says the KREMLIN banking campaign has shifted to forcing malicious extensions into Google Chrome and Microsoft Edge, rather than waiting for users to install them. The operation now reaches into browser sessions directly to steal credentials, session tokens, cookies, and other sensitive data.
The trick is a browser-check bypass: once the malware gets a foothold, it can install the extension without normal user approval. That matters because the extension can read what users type and capture the live token that keeps a banking or SaaS session open, so a password reset alone may not end the access.
For financial-services teams and anyone relying on Chrome or Edge for authenticated work, the exposure sits in the browser session layer. If an attacker already holds a valid token, the account can stay usable until that session is revoked, even after the password changes.
Malware bypasses browser checks to force install Chrome, Edge extensions
A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.