Elastic details KREMLIN campaign that forges Chrome integrity checks to steal bank sessions

What happened

Elastic Security Labs has documented a malware operation it tracks as KREMLIN, aimed at banking customers in Brazil, that force-installs a malicious browser extension without any approval from the user. The core trick: the malware edits Chrome's protected settings file and then recomputes the cryptographic values the browser uses to detect tampering, so the rogue extension loads as though it were an ordinary, user-installed add-on.

According to the research, summarised in a dev.to write-up, Elastic followed seven related campaigns over about 15 months, and requests to a canary domain registered by its researchers exposed 1,515 infected endpoints at the time of writing. BleepingComputer's related coverage highlights the same behaviour across both Chrome and Edge: browser checks bypassed, extensions installed by force.

The infection chain

The entry point is a JavaScript file dressed up as something routine — a bank receipt, an invoice, a payment record. When opened, it displays a fake error message and checks whether it is running inside an analysis environment. If the coast is clear, it downloads Node.js to run the later stages and creates a scheduled task to persist across reboots.

The infrastructure is deliberately decentralised. An Ethereum smart contract acts as a hidden directory that tells the malware where to fetch additional payloads and the extension package, while the Internet Archive and ordinary distribution sites host the files. Once installed, the extension takes its commands over WebSocket connections.

Beating the browser's integrity checks

Chromium browsers record installed extensions in a file called Secure Preferences and guard it with HMACs and encrypted hashes derived from machine-local keys — the OSCrypt and App-Bound keys. KREMLIN waits for a moment when the user is idle, closes Chrome or Edge if necessary, and copies its extension into the browser profile. It then reads the existing keys and regenerates the hashes and MACs so they match the modified file. On the next launch the browser's integrity check passes, and the extension, named AVSync, is treated as legitimately registered.

What AVSync does once inside

AVSync is a session-stealing toolkit. The write-up says it captures cookies, sessions, form input, screens, and HTTP traffic including bodies and headers, while receiving commands over WebSocket. Theft is not the only risk: Elastic notes that attackers can alter authenticated banking pages through HTML injection or clickjacking, including transfer screens, and that some infections escalate to remote control of the endpoint through REMCOS or PULSAR.

What defenders can watch for

The summary suggests observables across several log sources. Email gateways should flag .js attachments or download links disguised as invoices, receipts or payment records. Proxy and DNS logs can surface Ethereum RPC traffic, Internet Archive requests, the reported distribution and C2 domains, extension ZIP downloads, and WebSocket connections. On endpoints, the sequence to hunt is Node.js executed from script hosts such as wscript or cscript, new scheduled tasks, browsers being terminated, and writes to profiles or Secure Preferences. Identity logs may show access from unfamiliar IPs or devices if stolen cookies are replayed against banking or SaaS accounts.

Two patterns stand out. As single events: a Secure Preferences modification or an extension directory appearing immediately after Chrome or Edge closes. As a time series: JavaScript execution, Node.js retrieval, scheduled task creation, forced browser shutdown, profile modification, and then WebSocket activity on the same machine.

The write-up is also candid about limits. Integrity monitoring detects tampering but does not prevent it, and blocking distribution or C2 infrastructure disrupts later stages without removing an infection that is already in place.

Why it matters

KREMLIN shows why browser tamper protection cannot stand on its own. Chromium's hash-based integrity model assumes the machine's keys are uncompromised; once malware runs with the user's privileges, it can forge the browser's own signatures, and an extension that appears legitimately installed proves nothing. Defenders should treat Secure Preferences as a high-value monitored object and treat unsolicited script files as the gate to hold. The campaign's use of Ethereum contracts and the Internet Archive as hiding places for pointers and payloads also complicates infrastructure takedowns, since these are public services nobody can simply switch off. For organisations whose users bank online — above all in Brazil, where the operation concentrates — the practical response combines blocking script attachments, restricting Node.js and script-host execution on endpoints, alerting on profile writes that follow a browser shutdown, and revoking active sessions on any suspected infection.