Malicious Browser Extensions: KREMLIN Banking Malware Force-Installs Chrome/Edge Add-Ons on 1,515 Systems; Separate Research Shows Two-Permission Extensions Can Hijack AI…

Elastic tracked KREMLIN banking malware through at least seven campaigns since May 2025, silently installing an 'AVSync' extension in Chrome and Edge on 1,515 systems (98.75% in Brazil); separately, Forever Security showed a browser extension with two common…

Coverage on September 16, 2026 centers on malicious browser extensions in two distinct threads that the reports do not link to each other. First, Elastic Security Labs analyzed KREMLIN, a banking malware toolkit used by a Brazilian operation in at least seven campaigns since May 2025 (described by one report as spanning roughly 15 months), with 1,515 confirmed infected systems, 98.75% of them in Brazil (another report says 'almost all'). Portuguese-language lures impersonating 12 banks pose as bank receipts or invoices to trick users into opening a JavaScript file that performs anti-sandbox checks, downloads Node.js and persists via a scheduled task. Infrastructure locations are fetched from an Ethereum smart contract acting as a dead-drop resolver, with payloads hidden in JPEG images hosted on Internet Archive. KREMLIN bypasses Chromium integrity mechanisms by rewriting Secure Preferences and regenerating browser HMAC integrity hashes, silently installing an unapproved extension named AVSync into Chrome and Edge profiles without store installation or user approval. The extension requests tabs, cookies, storage and network permissions; it harvests passwords and session cookies, keylogs form input, captures screenshots, intercepts HTTP traffic and injects or redirects attacker-controlled page content. Recent campaigns deployed the REMCOS RAT and earlier ones the Pulsar RAT. Elastic disrupted infections by registering an anti-sandbox canary domain — one report describes the disruption as temporary — and a linked wallet handled roughly 20,800 USDT. Second, in unrelated research, Forever Security demonstrated that a browser extension with just two common permissions could seize the trusted page controlling built-in AI assistants in five Chromium-based products (Chrome, Edge, Perplexity Comet, Opera Neon and Claude in Chrome) to drive the agent, read local files or access the camera, earning $20,000 in bounties; all attacks require a malicious extension already installed. Perplexity Comet was the worst case: a hijacked agent could read any file, leak browsing history, take screenshots and act as the user via an unsecured test subdomain. Chrome's flaw was fixed as CVE-2026-0628 (CVSS 8.8) in Chrome 143.0.7499.192 and Microsoft's as CVE-2026-55945 (CVSS 4.2) in Edge 150.0.4078.48; the Comet, Opera Neon and Claude findings lack CVE assignments, and no in-the-wild exploitation or KEV listing was reported as of September 16, 2026. Recommended KREMLIN response:…

• Elastic Security Labs tracked the KREMLIN banking malware across at least seven campaigns since May 2025 (one report describes the activity as spanning 15 months), with 1,515 confirmed infections, 98.75% of them in Brazil.
• KREMLIN lures impersonate 12 banks using Portuguese-language JavaScript files disguised as bank receipts or invoices; after anti-sandbox checks it downloads Node.js and persists via a scheduled task.
• Infrastructure is resolved via an Ethereum smart contract acting as a dead-drop resolver; payloads are hidden in JPEG images hosted on Internet Archive.
• KREMLIN bypasses Chromium integrity mechanisms by rewriting Secure Preferences and regenerating HMAC integrity hashes, force-installing an unapproved 'AVSync' extension in Chrome and Edge without store installation or user approval.
• The AVSync extension requests tabs, cookies, storage and network permissions; it steals passwords and session cookies, keylogs form input, captures screenshots, intercepts HTTP traffic and injects or redirects attacker-controlled page…
• Recent KREMLIN campaigns deployed the REMCOS RAT; earlier campaigns used the Pulsar RAT.
• Elastic disrupted infections by registering an anti-sandbox canary domain (described as temporary in one report); a linked wallet handled roughly 20,800 USDT.
• KREMLIN response guidance: isolate devices, remove the extensions, and reset passwords and revoke sessions from a clean system.