Malware
Pulsar RAT
According to Broadcom, Pulsar RAT is a derivation of Quasar RAT, which has miscellaneous functionality including keylogging, cryptocurrency wallet clipping, infostealing, file management, remote shell and command execution, among others. The data theft capabilities of this malware include collection and exfiltration of sensitive information such as credentials, cookies, cryptowallets, session files and data stored in the system web browsers, etc.
Indicators of Compromise 11
Domain luizestrelhashapr[.]online Domain volmira[.]site Domain zaviro[.]online Filename AVSync Filename SentinelAgentCore.dll Filename SentinelMemoryScanner.exe GitHub Repo GhostChrome-X GitHub Repo Phantom Extension GitHub Repo elastic/kremlin-iocs MD5 ndpbidppejfanjbhfgjlohfanbfbklff Registry User ethereum_wallet_0x5a7c8e4b3d9f1d5a7c8e4b3d9f1d5a7c8e4b3d9f
MITRE ATT&CK TTPs 25
T1003 T1027 T1055 T1055.012 T1057 T1059.001 T1070.004 T1071.001 T1071.003 T1074 T1082 T1090 T1105 T1113 T1133 T1134 T1134.001 T1190 T1204 T1204.002 T1497 T1497.001 T1547 T1547.001 T1566
OS Credential Dumping
Credential Access
Obfuscated Files or Information
Defense Evasion
Process Injection
Defense Evasion
Process Hollowing
Defense Evasion
Process Discovery
Discovery
PowerShell
Execution
File Deletion
Defense Evasion
Web Protocols
Command And Control
Mail Protocols
Command And Control
Data Staged
Collection
System Information Discovery
Discovery
Proxy
Command And Control
Ingress Tool Transfer
Command And Control
Screen Capture
Collection
External Remote Services
Persistence
Access Token Manipulation
Defense Evasion
Token Impersonation/Theft
Defense Evasion
Exploit Public-Facing Application
Initial Access
User Execution
Execution
Malicious File
Execution
Virtualization/Sandbox Evasion
Defense Evasion
System Checks
Defense Evasion
Boot or Logon Autostart Execution
Persistence
Registry Run Keys / Startup Folder
Persistence
Phishing
Initial Access
Source Articles
Malware bypasses browser checks to force install Chrome, Edge extensions
A banking malware operation active since mid-2025, dubbed KREMLIN, has been force-installing malicious Chrome and Edge extensions to steal credentials, session tokens, and other sensitive data. The malware bypasses Chromium's integrity checks by copying extensions into browser profile directories and modifying Secure Preferences using extracted encryption keys and regenerated HMACs. The infection begins via malicious JavaScript files disguised as financial documents, establishes persistence through scheduled tasks, downloads Node.js, and retrieves payloads from Ethereum smart contracts or images hosted on the Internet Archive.
bleeping-computer ·1mo ago
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
KREMLIN is a Brazilian banking malware operation active since May 2025 that targets Chromium-based browsers to steal credentials, session tokens, and sensitive data. It uses multi-stage JavaScript loaders, C++ installers, and malicious browser extensions, evading sandbox detection by checking hardware properties and process names. The malware leverages Ethereum smart contracts as dead drop resolvers to dynamically update C2 infrastructure and employs DLL sideloading via a legitimate SentinelOne binary. It installs a malicious extension named 'AVSync System Inc.' that exfiltrates browser data through WebSocket and HTTP-based polling mechanisms.
hacker-news ·1mo ago