Threats · 44 days ago
BleepingComputer says the KREMLIN banking campaign has shifted to forcing malicious extensions into Google Chrome and Microsoft Edge, rather than waiting for users to install them. The operation now reaches into browser sessions directly to steal credentials, session tokens, cookies, and other sensitive data.
The trick is a browser-check bypass: once the malware gets a foothold, it can install the extension without normal user approval. That matters because the extension can read what users type and capture the live token that keeps a banking or SaaS session open, so a password reset alone may not end the access.
For financial-services teams and anyone relying on Chrome or Edge for authenticated work, the exposure sits in the browser session layer. If an attacker already holds a valid token, the account can stay usable until that session is revoked, even after the password changes.
3 sources covering this story
Malware bypasses browser checks to force install Chrome, Edge extensions
A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
KREMLIN targets Brazilian bank users with malicious Chrome and Edge extensions that steal credentials, session tokens, cookies, and browser data.
Malicious browser extension: inside KREMLIN banking malware
Elastic Security Labs analyzes a malicious browser extension that forges Chromium's integrity checks and pulls its C2 from Ethereum smart contracts.
Part of the PlainSec briefing for 2026-09-17