KREMLIN installers forge Chrome's Secure Preferences HMACs to register a stealer extension

Secure Preferences is Chromium's integrity check on its own settings, with an HMAC held per protected entry under protection.macs. The KREMLIN installer writes its extension entry in, switches on developer mode, and forges that metadata so the check passes. Elastic Security Labs names the public technique as Phantom Extension and GhostChrome-X.

"Malicious browser extensions bypass Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs, and App-Bound encrypted hashes," Elastic researchers Cyril François and Andrew Pease said.

The China-linked APT31 used the same file-rewriting approach in a late August 2026 campaign, paired with the BlueMoon exploit kit and now-patched Chrome and Windows zero-days, to install a credential-stealing extension called GemStone. REF9334 has been impersonating a dozen Brazilian banks since at least May 2025, roughly fifteen months earlier, and its delivery is a JavaScript file the victim double-clicks.

The blockchain component is a lookup. Stage two asks an Ethereum smart contract where to download from, then sets a scheduled task and runs stage three. The sideloaded DLL queries the same contract for two domains, volmira[.]site and zaviro[.]online, and asks the first for the extension version, 1.0.0, and its ID, ndpbidppejfanjbhfgjlohfanbfbklff. Elastic says the contract lets the operator update C2 endpoints and payload hosting dynamically so the infrastructure cannot be disrupted. Seizing either domain leaves the resolver readable and the implant unchanged.

Stage three is fussy about where it runs. It terminates if any running process matches a hardcoded name list, and it terminates unless the machine has 2 CPUs and more than 3 GB of RAM. A single-vCPU, 2 GB triage VM will produce a clean verdict on this sample.

The chain does leave plain artifacts. SentinelMemoryScanner.exe, a legitimate SentinelOne binary, sideloads an unsigned payload impersonating SentinelAgentCore.dll. The extension calls itself AVSync System Inc. and asks for tabs, cookies, storage and the webRequest API before it starts exfiltrating browser data for each profile to luizestrelhashapr[.]online on port 443. It writes a unique victim identifier into browser storage and includes it in C2 traffic.

Elastic's report documents the bypass of the Secure Preferences protection mechanism and does not address whether managed extension install policy stops the write. What the extension does once seated is documented: after opening a WebSocket to the C2, it takes screenshots of the selected or active tab, uploads them compressed, and enumerates tabs and domains.

"Before downloading the archive, the malware checks whether the extension is already installed and, if so, compares the installed version with the version reported by the server," the researchers said. It pulls the ZIP only when nothing is installed locally or the versions differ.