KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension
AI summary · glm-5.3-flashSummaries by Vani AI
Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.
Elastic researchers tracked the KREMLIN banking malware operation across seven campaigns over 15 months, infecting 1,515 systems, 98.75% of them in Brazil. Portuguese-language lures posing as bank records and invoices deploy a hostile 'AVSync' extension into Chrome and Edge profiles that harvests passwords, session cookies, keystrokes and screenshots. Loaders check for sandboxes, create scheduled tasks and fetch fresh infrastructure from an Ethereum smart contract; a network canary takeover temporarily disrupted infections.
Key facts
- The extension requests tabs, cookies, storage and network permissions, captures keystrokes and injects attacker-controlled page content.
- Tampering with Chrome's protected preferences makes the unapproved extension appear legitimate without store installation.
- Blockchain-hosted configuration lets operators rotate infrastructure without rebuilding samples, complicating static blocking.
- Response guidance: isolate devices, remove extensions, reset passwords and revoke sessions from a clean system.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | acrobat-updater.com | n[.]online Earlier campaign extension-hosting domain Domain acrobat-updater[.]com Earlier campaign lure and payload-hosting domain Domain l |
| domain | codecaudiog.site | rastructure associated with a related KREMLIN branch Domain codecaudiog[.]site Earlier KREMLIN campaign staging domain Domain codecvideo |
| domain | codecvideowin.online | udiog[.]site Earlier KREMLIN campaign staging domain Domain codecvideowin[.]online Earlier campaign extension-hosting domain Domain acrobat- |
| domain | connection.upgradeonline.site | 51a9b9 PowerShell extension-installer implementation Domain connection[.]upgradeonline[.]site Loader beaconing and extension-delivery infrastructure |
| domain | cremeb.com | itily[.]workers[.]dev FrameSync campaign C2 resolver Domain cremeb[.]com QR-extension and earlier KREMLIN campaign infrastructure |
| domain | donalurdesconfeitos.site | xtension and earlier KREMLIN campaign infrastructure Domain donalurdesconfeitos[.]site Earlier extension-delivery infrastructure Domain marialur |
| domain | granderevolucao.store | yfans[.]net Network canary domain checked by KREMLIN Domain granderevolucao[.]store Installer payload-hosting domain Domain volmira[.]site Ex |
| domain | graph.checkeligibitily.workers.dev | nline Exfiltration and fingerprinting infrastructure Domain graph[.]checkeligibitily[.]workers[.]dev Extension endpoint resolver Domain luizestrelhashapr[ |
| domain | harialurdes.site | ialurdes[.]site Intermediate KREMLIN campaign domain Domain harialurdes[.]site Intermediate KREMLIN campaign domain IP address 178.92.16 |
| domain | lojinhadoluiz.online | com Earlier campaign lure and payload-hosting domain Domain lojinhadoluiz[.]online FrameSync campaign extension infrastructure Domain orange |
| domain | luizestrelhashapr.online | gibitily[.]workers[.]dev Extension endpoint resolver Domain luizestrelhashapr[.]online Resolved WebSocket command-and-control host Domain segura |
| domain | marialurdes.site | tos[.]site Earlier extension-delivery infrastructure Domain marialurdes[.]site Intermediate KREMLIN campaign domain Domain harialurdes[. |
| domain | orange-sun-195a.checkeligibitily.workers.dev | .]online FrameSync campaign extension infrastructure Domain orange-sun-195a[.]checkeligibitily[.]workers[.]dev FrameSync campaign C2 resolver Domain cremeb[.]com QR |
| domain | seguranca.versionnova.site | .]online Resolved WebSocket command-and-control host Domain seguranca[.]versionnova[.]site Infrastructure associated with a related KREMLIN branch |
| domain | volmira.site | derevolucao[.]store Installer payload-hosting domain Domain volmira[.]site Extension hosting and credential-exfiltration infrastruct |
| domain | www.creamp1eonlyfans.net | ader beaconing and extension-delivery infrastructure Domain www[.]creamp1eonlyfans[.]net Network canary domain checked by KREMLIN Domain grander |
| domain | zaviro.online | n hosting and credential-exfiltration infrastructure Domain zaviro[.]online Exfiltration and fingerprinting infrastructure Domain gra |
| ipv4 | 144.172.112.239 | Earlier PULSAR RAT command-and-control endpoint IP address 144.172.112[.]239:4782 Acrobat campaign PULSAR RAT endpoint IP address 45.9 |
| ipv4 | 178.92.162.38 | rdes[.]site Intermediate KREMLIN campaign domain IP address 178.92.162[.]38:443 REMCOS RAT command-and-control endpoint IP address 18 |
| ipv4 | 185.221.23.133 | .]38:443 REMCOS RAT command-and-control endpoint IP address 185.221.23[.]133:4782 Earlier PULSAR RAT command-and-control endpoint IP a |
| ipv4 | 37.16.74.100 | 3[.]210:443 Acrobat campaign PULSAR RAT endpoint IP address 37.16.74[.]100:443 Cremeb campaign PULSAR RAT endpoint IP address 37.16. |
| ipv4 | 37.16.74.34 | 74[.]100:443 Cremeb campaign PULSAR RAT endpoint IP address 37.16.74[.]34:443 Cremeb campaign PULSAR RAT endpoint Ethereum smart co |
| ipv4 | 45.90.13.210 | [.]239:4782 Acrobat campaign PULSAR RAT endpoint IP address 45.90.13[.]210:443 Acrobat campaign PULSAR RAT endpoint IP address 37.16 |
| sha256 | 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 | s of compromise (IoCs):- Type Indicator Description SHA-256 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 KREMLIN JavaScript loader sample SHA-256 5ece7fd3766b0b7f8a |
| sha256 | 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c | 70e83abba66ee07bcecea0 Related Wave B loader sample SHA-256 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c Related Wave C loader sample SHA-256 42a3e2bb135fb46b11b127 |
| sha256 | 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca | 81bdd66a4268 KREMLIN x64 extension installer binary SHA-256 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca Malicious AVSync extension sample SHA-256 ba80216c960977fa4 |
| sha256 | 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9 | fcb07739a10e4331e15a2c Related Wave C loader sample SHA-256 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9 PowerShell extension-installer implementation Domain connec |
| sha256 | 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 | aa75b2635cbdc0fa42 KREMLIN JavaScript loader sample SHA-256 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 First-stage popup JavaScript sample SHA-256 c8c38634dd44d7c |
| sha256 | ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f | 3811930de66c3f7ca Malicious AVSync extension sample SHA-256 ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f Related Wave A loader sample SHA-256 cb15cbf3f01a92e609e4c2 |
| sha256 | c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 | 89910e5be44f552 First-stage popup JavaScript sample SHA-256 c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 KREMLIN x64 extension installer binary SHA-256 223be3f8648b |
| sha256 | cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0 | a737cbc0bf86e929c3be5f Related Wave A loader sample SHA-256 cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0 Related Wave B loader sample SHA-256 170dffb37e05f525f735bc |
From the original article
5 min read at cybersecuritynews.com
KREMLIN is a banking malware operation that plants a hostile browser extension on infected computers. The extension can harvest passwords, session cookies, and other data that can let criminals enter online accounts. The campaign begins with fake JavaScript documents that pose as bank records or invoices.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.