other

Secure Preferences

Chromium's HMAC-protected preferences store, which signs settings such as the installed-extension list so the browser can detect modification from outside itself.

Known aliases

protection.macs
Secure Preferences

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 publisher

KREMLIN forges Chromium's Secure Preferences HMACs with keys already on the endpoint

Elastic Security Labs describes a Brazilian banking operation that edits a Chrome or Edge profile and then signs its own edit using the OSCrypt and App-Bound keys sitting on the same machine. The browser loads the extension as approved.

Publishers:dev.to

Reality

Evidence62
Adoption35
Hype gap−10
Incentives45
Confidence58

security1 publisher

KREMLIN installers forge Chrome's Secure Preferences HMACs to register a stealer extension

Elastic Security Labs says the Brazilian crew it calls REF9334 has been running this since at least May 2025, writing its extension into Chromium's Secure Preferences and reading C2 addresses out of an Ethereum smart contract.

Publishers:thehackernews.com

Reality

Evidence62
Adoption42
Hype gap+12
Incentives55
Confidence58