As reported by Elastic Security Labs, the KREMLIN banking malware operation (tracked as REF9334) has spent over 15 months quietly perfecting a technique that should concern every defender responsible for endpoint or browser security: defeating Chromium's built-in extension integrity mechanisms to install malicious add-ons without user consent.

Threat Alert: As reported by Elastic Security Labs, the KREMLIN banking malware operation (tracked as REF9334) has spent over 15 months quietly perfecting a technique that should concern every defender responsible for endpoint or browser security: defeating Chromium's built-in extension integrity mechanisms to install malicious add-ons without user consent.

The most technically significant detail is not the social-engineering lures or the multi-stage JavaScript loader — both are well-trodden paths for Brazilian banking trojan operators. The real escalation is that KREMLIN manipulates Chrome's Secure Preferences file, regenerates the required HMACs, and rewrites App-Bound encrypted hashes so the browser loads the malicious extension as though it were legitimately user-approved. This is the integrity control that was supposed to prevent exactly this class of attack after years of abuse via side-loaded extensions and rogue preferences.

Why This Matters Beyond Brazil

Brazilian banking malware has historically stayed regional, but the techniques rarely do. The combination of capabilities here — forged extension integrity, blockchain-based C2 resolution, and kill-switch domains embedded as network canaries — is a template that will be copied by operators targeting North American and European financial institutions. The Ethereum smart-contract dead-drop resolver is particularly notable: it removes a single point of failure from traditional C2 infrastructure and makes domain takedowns far less effective. Elastic's disruption of 1,500+ infections via a canary domain is impressive, but the architecture guarantees the operators will simply re-deploy.

Who Is Most Exposed

Why This Matters Beyond Brazil
Retail banking customers in Latin America, particularly Brazil, where boleto and PIX payment lures remain highly effective.
Enterprise endpoints where users have local administrator rights — KREMLIN's C++ installer needs sufficient privilege to rewrite the Secure Preferences file and regenerate HMACs.
Unmanaged browser deployments — BYOD environments and contractors using personal devices for corporate banking are effectively unprotected.
Any organization relying solely on browser-level extension allowlisting without OS-level monitoring of the Secure Preferences file and extension directories.

The Integrity Bypass Is the Story

Chrome's App-Bound encryption, introduced to protect Local State and sensitive preference entries from tampering by non-elevated processes, was meant to close the door on malicious extension injection. KREMLIN demonstrates that if an attacker has code execution at sufficient privilege — even briefly — they can forge the HMAC and regenerate the App-Bound hash so Chromium treats the extension as trusted on next launch. This is not a zero-day in the traditional sense; it is an abuse of design assumptions under conditions the browser cannot distinguish from legitimate administrative activity.

The defensive gap is that Chromium trusts the integrity of files on disk. Once an attacker can write to those files with the right cryptographic material, the browser has no independent ground truth to challenge the installation.

That means the defense cannot live inside the browser alone. Detection must move to the endpoint: file integrity monitoring on extension directories, behavioral alerting on processes that write to Secure Preferences outside of Chrome's own update flow, and network controls that block unsanctioned outbound connections to Ethereum RPC endpoints used for C2 resolution.

Shield53 Recommendations

  • Restrict local admin rights — KREMLIN's installer requires privilege to forge extension integrity. Removing admin from daily-driver accounts eliminates the majority of infections.
  • Deploy browser extension blocklists via enterprise policy (Chrome's ExtensionInstallBlocklist and ExtensionInstallAllowlist) and monitor for policy tampering events.
  • Implement file integrity monitoring on %LocalAppData%\Google\Chrome\User Data\Default\Secure Preferences and the Extensions directory; alert on any write from a non-Chrome process.
  • Block outbound traffic to public Ethereum RPC endpoints (Infura, Alchemy, public nodes) from non-developer workstations — this strangles the C2 resolver mechanism.
  • Hunt for the loader — JavaScript files delivered via banking-themed lures that call bracket-notation method dispatch and perform sandbox checks. Elastic published the analyzed hash 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 as a starting pivot.
  • Educate finance teams on document-lure attacks; the initial infection still requires a user to execute a JavaScript file masquerading as an invoice or banking document.

The broader implication is clear: browser vendors cannot solve extension integrity alone. The trust boundary between the OS and the browser is porous whenever an attacker obtains local execution, and resilient C2 architectures like blockchain dead-drops make takedown-based defense increasingly futile. Defenders need to assume the browser is a contested surface and instrument accordingly.