New KREMLIN Malware Bypasses Browser Integrity Checks for Malicious Extension Installation
A newly discovered malware named KREMLIN is bypassing browser integrity checks to silently install malicious extensions on Chrome and Edge. The malware has been active for over a year.
A novel piece of malware, dubbed KREMLIN, has been identified for its ability to bypass browser integrity checks and forcibly install malicious extensions on Google Chrome and Microsoft Edge without user consent. Researchers indicate this malware has been active for over a year, with early instances dating back to mid-2025.
The KREMLIN malware chain typically begins when a user opens a disguised JavaScript file, often masquerading as financial documents like bank receipts or invoices. After evading sandbox detection, the script triggers a fake error message while secretly downloading Node.js and establishing persistence via scheduled tasks.
Further analysis reveals KREMLIN's sophisticated approach to extension installation. It waits for the browser to close or terminates the process if idle, then copies the malicious extension into the browser's user profile directory. By enabling developer mode and modifying Chromium's secure preferences, it tricks the browser into recognizing the extensions as legitimately installed.
Once installed, the extension, posing as "AVSync," engages in data theft. It can exfiltrate cookies, local storage, and session data, log keystrokes including passwords, capture screenshots, and collect browsing history. It also has the capability to inject malicious HTML content and redirect user actions.
Researchers at Elastic Security Labs successfully disrupted ongoing KREMLIN campaigns by registering domains used by the malware as anti-sandbox probes, thereby hindering its operation and data exfiltration capabilities.