The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

KREMLIN is an active Brazilian-targeted banking malware ecosystem that uses multi-stage JavaScript loaders, Node.js/RunPE installers, and a C++ installer to deploy malicious Chromium extensions (and RATs like PULSAR/REMCOS) that steal credentials, session tokens, and browser data; operators use Ethereum smart contracts as dead-drop resolvers for dynamic C2 configuration and have distributed payloads via Internet Archive carriers. The report details seven campaigns from mid-2025 to 2026, technical internals (sandbox evasion, indirect syscalls, SentinelOne sideloading, OSCrypt/App-Bound key extraction, Secure Preferences tampering), infrastructure and wallet transactions, and provides comprehensive indicators of compromise and telemetry including a network canary showing ~1,515 infected systems (predominantly Brazil).