57
42
30
30
42
45
30
57
42
30
60
45
KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension
Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.
Elastic researchers tracked the KREMLIN banking malware operation across seven campaigns over 15 months, infecting 1,515 systems, 98.75% of them in Brazil. Portuguese-language lures posing as bank records and invoices deploy a hostile 'AVSync' extension into Chrome and Edge profiles that harvests passwords, session cookies, keystrokes and screenshots. Loaders check for sandboxes, create scheduled tasks and fetch fresh infrastructure from an Ethereum smart contract; a network canary takeover temporarily disrupted infections.
52
45
30
42
45
30
30
30
42
42
FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs
Fortinet patched CVE-2026-84388 (CVSS 9.1) in its FortiPAM Chrome extension, letting malicious websites alter proxy settings, open tabs and record sessions.
The Fortinet FortiPAM Chrome extension flaw (CVE-2026-84388, CVSS 9.1) lets attacker-controlled domains be trusted as FortiPAM servers because a webRequest listener adds requested hostnames without verifying the initiator. A second issue exposes the extension's message interface to all URLs and accepts non-JWT tokens without validation, enabling unauthenticated session launches, proxy manipulation, tab control and recording; the consent dialog can also be bypassed via shadow-root clicks. Fortinet issued advisory FG-IR-26-168 after a July 17 report and released a fix on August 1, 2026, with no confirmed exploitation in the wild.
48
57
30
30
30
30
30
45
30
42
45
30
42
30
35
45
55
45