The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Elastic Security LabsSeptember 14, 2026Threat Intel

Elastic Security Labs tracked this malicious browser extension across seven campaigns and 15 months, through Brazilian bank lures and the Ethereum smart contracts that hold its C2 configuration.

Summary from Elastic Security Labs.

Read the full article at Elastic Security Labs

Explained

The technology and terms in this story. Learn more

ConceptCommand and control · C2The servers attackers use to send instructions to their malware and receive stolen data.

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Explained

More in Threat Intel

Synthetic identities leave US lenders with $2.4 billion in fraud exposure

Sponsored: Should your threat hunt become a detection?

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet