As reported by BleepingComputer, researchers at Elastic Security Labs have uncovered a banking malware toolkit dubbed KREMLIN that achieves something most defenders assumed was prevented by design: silently installing browser extensions without user consent on Chrome and Edge. This is not a minor technical curiosity. It is a structural defeat of one of Chromium's core trust boundaries, and it warrants immediate attention from any organization whose users handle financial credentials, session tokens, or sensitive documents in the browser.

Threat Alert: As reported by BleepingComputer, researchers at Elastic Security Labs have uncovered a banking malware toolkit dubbed KREMLIN that achieves something most defenders assumed was prevented by design: silently installing browser extensions without user consent on Chrome and Edge.

Why This Breaks the Browser Trust Model

Chromium-based browsers enforce extension integrity through a combination of Secure Preferences files, HMAC signatures, and encrypted hashes stored alongside the browser profile. When a user installs an extension through the official store, these mechanisms record a trusted state. Any subsequent tampering with the profile directory should trigger a mismatch and force the browser to disable or alert on the extension. KREMLIN's operators have reverse-engineered this process: they extract the browser's own encryption keys, manually place the extension payload in the profile directory, enable developer mode, and then regenerate valid HMACs and hashes so Chromium accepts the extension as legitimately installed.

This is significant because it means the extension loads without any user prompt, without a browser restart notification, and without triggering the warning banners that normally accompany sideloaded add-ons. From the browser's perspective, the extension is trusted. From the defender's perspective, there is no obvious alert — unless you are actively monitoring the filesystem-level changes to the profile directory and correlating them with extension manifest signatures.

The most dangerous aspect of KREMLIN is not the extension itself — it is that the browser's own integrity model has been weaponized to vouch for the attacker's code.

The Infection Chain and Blockchain Abstraction

The initial access vector is unremarkable by modern standards: a JavaScript file disguised as a financial document. What elevates the operation is its operational tradecraft. The malware passes anti-sandbox checks, silently downloads a Node.js runtime, establishes persistence via scheduled tasks, and — notably — retrieves payload staging locations from an Ethereum smart contract. This blockchain-based C2 abstraction gives operators a censorship-resistant, tamper-evident infrastructure that is trivially updated and difficult to take down. Expect this pattern to proliferate across additional malware families.

Extension Capabilities and Blast Radius

Once installed under the guise of a fake AVSync extension, the payload has broad access to the browser's runtime environment. Capabilities include:

The Infection Chain and Blockchain Abstraction
Credential and session theft: Cookies, local storage, and session storage are exfiltrated — enabling session hijacking that bypasses MFA.
Form keylogging: Keystrokes entered into web forms are captured before encryption in transit.
Content injection: Attacker-controlled HTML can be injected into rendered pages, enabling phishing overlays or transaction manipulation on banking portals.
Click redirection: Click events can be silently redirected to attacker-controlled destinations.
WebSocket-based C2: Real-time command execution through a persistent WebSocket channel.

For financial institutions, corporate treasury teams, and any organization where users authenticate to sensitive web applications through Chromium-based browsers, the risk profile is severe. Session token theft in particular can grant attackers persistent access to authenticated sessions even when credentials are never exposed and MFA is enforced.

Shield53 Recommendations

Immediate Actions

  • Audit extension inventories: Enumerate all installed extensions across managed Chrome and Edge deployments using EDR or GOM policies. Flag any extension with a name matching AVSync or that appears in developer mode without an approved deployment record.
  • Restrict developer mode: Disable developer mode on managed browsers via Group Policy (DeveloperToolsAvailability set to 3 — disallow on all extensions). This blocks the sideloading path KREMLIN relies on.
  • Block unsolicited JS execution: Enforce AppLocker or Windows Defender Application Control policies to prevent execution of JavaScript files from user-writable locations (Downloads, AppData, Temp).
  • Monitor profile directory changes: Deploy file integrity monitoring on %LocalAppData%\Google\Chrome\User Data\ and %LocalAppData%\Microsoft\Edge\User Data\ — specifically the Secure Preferences and Extensions subdirectories. Alert on writes outside of browser process activity.
  • Hunt for Node.js anomalies: KREMLIN downloads a portable Node.js runtime. Look for node.exe running from non-standard paths, particularly under %LocalAppData% or %Temp%.
  • Review scheduled tasks: Enumerate and baseline all scheduled tasks on endpoints. KREMLIN establishes persistence this way; any new task referencing scripts or executables in user-writable paths should be treated as suspicious.

Strategic Hardening

  • Enforce extension allowlists: Use Chrome Enterprise policies (ExtensionInstallAllowlist, ExtensionInstallBlocklist, ExtensionInstallSources) to restrict extensions to an approved set and block all other install sources.
  • Deploy DLP and session monitoring: Consider browser isolation or session recording for high-risk users handling financial transactions. Session token theft is the highest-impact outcome here.
  • Implement ETH address monitoring: For threat intelligence teams, monitor known Ethereum smart contracts associated with KREMLIN infrastructure for configuration updates that may signal new campaign waves.

The KREMLIN toolkit demonstrates that browser extension security models, while robust against casual tampering, are not invulnerable to a determined operator with filesystem access. As long as the browser trusts its own profile directory as a source of truth, any malware that achieves local code execution on the host can potentially subvert that trust. The defense layer that matters most is not the browser — it is what you have surrounding it.