The extension you never installed: KREMLIN forges Chrome’s own integrity checks to steal banking sessions

Summary

KREMLIN is a sophisticated malware ecosystem targeting Brazilian banking users through multi-stage JavaScript loaders and malicious browser extensions. The threat actors abuse Ethereum smart contracts as dead-drop resolvers to manage C2 infrastructure and bypass Chromium integrity protections. The malware can steal session tokens, cookies, and sensitive credentials from Chrome and Edge browsers.

Investigation

Elastic Security Labs tracked KREMLIN across seven campaigns spanning 15 months, analyzing its multi-stage infection chain and C++ installer. Researchers identified Ethereum-based dead-drop resolvers, side-loading through legitimate SentinelOne binaries, and manipulation of Chromium Secure Preferences files to install unauthorized extensions. The investigation also uncovered campaign-specific markers, including unique customer IDs and mutexes.

Mitigation

Organizations should monitor unauthorized changes to Chromium Secure Preferences files and suspicious browser debugging activity. Strict controls on scheduled tasks and monitoring for unusual Node.js execution can help reduce exposure. Network monitoring should also detect connections to known malicious domains and unexpected Ethereum smart contract queries originating from client endpoints.

Response

If KREMLIN activity is detected, affected endpoints should be isolated immediately to prevent session exfiltration and credential theft. Responders should examine browser profile directories for unauthorized extensions and remove malicious components. Scheduled tasks and running processes should also be audited for suspicious Node.js or SentinelOne-related activity, while potentially compromised credentials and active web sessions should be reset.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access and is attempting to evade sandbox analysis. To do this, they deploy a secondary payload disguised as a system process (missioncritical.exe) and attempt to interact with virtualization processes (vmmemctl.exe) to detect if they are running in a VM. Finally, they utilize PowerShell to orchestrate the next stage of the infection. These specific process names are the triggers for the detection rule.

• Regression Test Script:

    # Simulation script for KREMLIN Malware indicators
  
    # 1. Simulate PowerShell execution (Targeted by rule)
    Write-Host "[*] Triggering PowerShell detection..."
    powershell.exe -Command "Write-Host 'Simulating malicious activity'"
  
    # 2. Simulate the creation of 'missioncritical.exe' (Targeted by rule)
    # We create a dummy file and attempt to 'execute' it via start-process 
    # to generate a process creation event for the filename.
    Write-Host "[*] Triggering missioncritical.exe detection..."
    New-Item -Path "$env:TEMPmissioncritical.exe" -ItemType File -Force
    Start-Process "$env:TEMPmissioncritical.exe" -ErrorAction SilentlyContinue
  
    # 3. Simulate the creation of 'vmmemctl.exe' (Targeted by rule)
    Write-Host "[*] Triggering vmmemctl.exe detection..."
    New-Item -Path "$env:TEMPvmmemctl.exe" -ItemType File -Force
    Start-Process "$env:TEMPvmmemctl.exe" -ErrorAction SilentlyContinue

• Cleanup Commands:

    # Cleanup simulation artifacts
    Remove-Item -Path "$env:TEMPmissioncritical.exe" -Force -ErrorAction SilentlyContinue
    Remove-Item -Path "$env:TEMPvmmemctl.exe" -Force -ErrorAction SilentlyContinue
    Write-Host "[+] Cleanup complete."