Banking malware

KREMLIN forges the HMACs Chromium uses to prove a user approved an extension

Elastic Security Labs tied 1,515 infections, almost all in Brazil, to a loader that waits for Chrome to close and then writes its own extension into the profile directory with integrity hashes the browser accepts.