KREMLIN

highMalware

KREMLIN Banking Malware Bypasses Browser Checks to Force-Install Malicious Chrome, Edge Extensions

A banking malware operation using the KREMLIN toolkit has been active since mid-2025, bypassing browser security checks to force-install malicious Chrome and Edge extensions. These extensions steal credentials, session tokens, and sensitive data. The operation was reported by BleepingComputer on September 16, 2026. Users are advised to update browsers and exercise caution with extensions.

BleepingComputer13 days ago1 min read

highMalware

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Researchers at Elastic Security Labs have identified a previously undocumented Brazilian banking malware operation, tracked as REF9334, that delivers a toolkit called KREMLIN. Active since at least May 2025, the threat actor uses lures impersonating a dozen Brazilian banks to install malicious browser extensions on Google Chrome and Microsoft Edge, enabling credential theft and session token hijacking.

The Hacker News13 days ago2 min read

KREMLIN

Quick answers

Related Articles

KREMLIN Banking Malware Bypasses Browser Checks to Force-Install Malicious Chrome, Edge Extensions

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens