Security1 publisher3 min readPublished
KREMLIN forges the HMACs Chromium uses to prove a user approved an extension
Elastic Security Labs tied 1,515 infections, almost all in Brazil, to a loader that waits for Chrome to close and then writes its own extension into the profile directory with integrity hashes the browser accepts.
The Watch · Security desk
What happened
- Elastic Security Labs ties the KREMLIN toolkit to a Brazilian operation behind at least seven campaigns since May 2025, using lures that impersonate 12 banks.
- The extension poses as AVSync and steals cookies and storage, logs passwords typed into forms, captures screenshots and page source, injects attacker HTML, and takes commands over a WebSocket.
- Elastic confirmed 1,515 infected systems, almost all in Brazil, and stalled the running campaign by registering a domain the loader checks as an anti-sandbox canary.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Policies written as "user-approved extensions only" rest on a record the browser itself validates, and a local process that holds the browser's own keys can produce that record on demand.
- exposure Cookies, session storage and the App-Bound keys leave the machine together, so an attacker can resume an authenticated banking session after the victim changes the password.
- capability Payload pointers held in an Ethereum contract cannot be seized or sinkholed, so a defender's win looks like Elastic's: block the loader's own checks rather than take the resolver away.
- precedent A technique the researchers call documented but rarely observed now ships in a commodity banking crew's loader, which is where other operators go looking for working code.
Chromium records an installed extension as an entry in the Secure Preferences file and protects that entry with cryptographic integrity checks. KREMLIN rewrites the record. It waits for Chrome or Edge to close, or kills the process when it detects the machine idle, copies the extension into the profile directories, enables developer mode, and registers the extension in Secure Preferences [6]. Then it retrieves the keys the browser uses to protect sensitive data and regenerates the checks, so the extension loads as valid [7].
"KREMLIN uses a documented technique rarely observed in malware: it manually copies the extension into the browser's profile directories and registers it in the Secure Preferences file," Elastic Security Labs said [8]. "Because Chromium protects these entries with cryptographic integrity checks, the malware must retrieve the required keys and regenerate the associated HMACs and encrypted hashes" [9].
No browser bug is involved. The operator already has code running as the user before any of this starts: the chain begins with a JavaScript file opened as a bank receipt or invoice [4], and after anti-sandbox checks the loader throws a fake error, pulls down Node.js, sets a scheduled task, and reads the next payload location out of an Ethereum smart contract [5].
The approval flag is only as trustworthy as the file that stores it, and that file sits in a directory the user owns. What is left to detect is the write: a new folder appearing under the profile's Extensions path, and Secure Preferences changing while the browser was not running [6].
Beyond the extension, the toolkit archives and exfiltrates browser databases, cookies, installed extension lists, and the App-Bound cryptographic keys needed to decrypt protected data [12].
Elastic confirmed 1,515 infected systems, almost all in Brazil [16]. Spread across at least seven campaigns since May 2025, that averages about 216 machines per campaign [3][3]. The Ethereum wallet that deployed and updated the dead-drop contracts handled roughly 20,800 USDT incoming and 19,000 USDT outgoing [15], about 39,800 USDT of movement in total [1], or roughly 26 USDT per confirmed infection [2]. Those are transfers through the deployer wallet, and Elastic did not put a figure on what the crew earned.
The disruption was cheap and narrow. Elastic registered a domain the malware used as an anti-sandbox canary, which makes the loader read a false flag and stop on systems that would otherwise qualify for infection [17]. The delivery side is untouched: payloads still sit inside JPEG images hosted on the Internet Archive [13], and recent campaigns drop REMCOS where earlier ones pushed Pulsar, a switch the researchers attribute to REMCOS being more feature rich [14]. Elastic published the tactics and a set of indicators of compromise [18].
What to watch
- Whether the operator changes the anti-sandbox canary domain, which would end the effect of Elastic's registration.
- Whether Chromium changes how Secure Preferences keys are stored so local code can no longer regenerate the HMACs.
- Whether the Secure Preferences installation technique shows up in loaders outside the Brazilian banking crews.