bleeping-computer · Crawled Sep 16, 2026
Malware bypasses browser checks to force install Chrome, Edge extensions
3 IoCs 2 Malware
Read original article ↗
AI Summary
A banking malware operation active since mid-2025, dubbed KREMLIN, has been force-installing malicious Chrome and Edge extensions to steal credentials, session tokens, and other sensitive data. The malware bypasses Chromium's integrity checks by copying extensions into browser profile directories and modifying Secure Preferences using extracted encryption keys and regenerated HMACs. The infection begins via malicious JavaScript files disguised as financial documents, establishes persistence through scheduled tasks, downloads Node.js, and retrieves payloads from Ethereum smart contracts or images hosted on the Internet Archive.
AI-extracted · verify before operational use
Extracted Entities 2 found
Indicators of Compromise 3 extracted
MITRE ATT&CK TTPs 40 techniques
T1003 OS Credential Dumping · Credential Access T1012 Query Registry · Discovery T1027 Obfuscated Files or Information · Defense Evasion T1027.013 Encrypted/Encoded File · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1057 Process Discovery · Discovery T1059.001 PowerShell · Execution T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1074 Data Staged · Collection T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1102.001 Dead Drop Resolver · Command And Control T1105 Ingress Tool Transfer · Command And Control T1112 Modify Registry · Defense Evasion T1113 Screen Capture · Collection T1133 External Remote Services · Persistence T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1204.002 Malicious File · Execution T1490 Inhibit System Recovery · Impact T1543.003 Windows Service · Persistence T1548.002 Bypass User Account Control · Privilege Escalation T1555.003 Credentials from Web Browsers · Credential Access T1564.003 Hidden Window · Defense Evasion T1566 Phishing · Initial Access T1608.001 Upload Malware · Resource Development T1685 T1685 T1055.012 Process Hollowing · Defense Evasion T1071.003 Mail Protocols · Command And Control T1134 Access Token Manipulation · Defense Evasion T1134.001 Token Impersonation/Theft · Defense Evasion T1204 User Execution · Execution T1497 Virtualization/Sandbox Evasion · Defense Evasion T1497.001 System Checks · Defense Evasion T1547 Boot or Logon Autostart Execution · Persistence T1547.001 Registry Run Keys / Startup Folder · Persistence