KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious 'AVSync' Extension
KREMLIN Banking Malware Forges Chrome/Edge Secure (TL-2026-2544), also tracked as CHROMEBALLRAT (earlier campaign name), is a high-severity malware campaign, first published 2026-09-16. It is attributed to REF9334 with medium confidence, affects Google Google Chrome, maps to 18 MITRE ATT&CK techniques (T1008, T1027, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-2544
- Threat ID
- TL-2026-2544
- Also known as
- CHROMEBALLRAT (earlier campaign name)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-16
- Last reviewed
- 2026-09-16
- Attribution
- REF9334
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, payments
- Target regions
- brazil, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in KREMLIN Banking Malware Forges Chrome/Edge Secure
Malware and tooling: KREMLIN, PULSAR, Pulsar RAT, REMCOS
A Brazilian cybercriminal operation (Elastic tracking designation REF9334) is distributing a multi-stage banking trojan toolkit called KREMLIN that manually recomputes the HMAC and encrypted-hash integrity values inside Chrome/Edge's Secure Preferences file, letting it silently register a malicious extension disguised as 'AVSync' without tripping the browser's unauthorized-extension protections. The extension steals cookies, session/local storage, browser credentials, form input, screenshots and page content, and reports to a WebSocket/HTTP C2 that KREMLIN increasingly resolves via an Ethereum smart-contract dead drop.
How KREMLIN Banking Malware Forges Chrome/Edge Secure works
KREMLIN is a Brazilian banking-malware toolkit, first observed in the wild around May 21, 2025 and formally branded 'KREMLIN' (author handle Kr3mlin4rt1st, v1.33+) in a JSE file header dated February 8, 2026. Elastic Security Labs, tracking the cluster as REF9334, documents seven distinct campaigns spanning 15+ months (Codecaudiog A/B, Acrobat, Framesync, Donalurdesconfeitos-Cremeb, Cremeb, and an ongoing 'Ethereum Transition' wave), all delivered via JavaScript files disguised as invoices, receipts, or payment confirmations impersonating 12 Brazilian banks and payment platforms (Banco do Brasil, Caixa, Bradesco, Sicoob, C6 Bank, Inter, BTG Pactual, Safra, PagBank, PicPay, Santander, Mercado Pago).
After the initial JavaScript stage performs basic obfuscation and sandbox/VM checks, it downloads a Node.js runtime and establishes persistence via a scheduled task ('MicrosoftNodeRuntimeUpdater', triggered at logon and every 30 minutes) that resolves further configuration through an Ethereum smart contract used as a dead-drop resolver. A C++ installer (~2.10MB, x64) is then delivered via DLL side-loading against a legitimate SentinelOne binary, which drops the final payload: the malicious Chrome/Edge extension plus either the PULSAR RAT (v1.6.6-2.4.5) or, from May 2026 onward, REMCOS RAT.
The extension-installation technique is the novel core of this threat: rather than relying on a known Chromium vulnerability, the installer extracts the legacy OSCrypt key from Chrome's Local State file (stripping the 5-byte DPAPI prefix and calling CryptUnprotectData), then launches Chrome under a debugger with --no-startup-window to intercept the LOAD_DLL_DEBUG_EVENT for chrome.dll, scans its .rdata section for the string 'OSCrypt.AppBoundProvider.Decrypt.ResultCode', and uses RIP-relative LEA instruction pattern matching to recover the App-Bound encryption key directly from process memory, together with a seed pulled from the browser's resources.pak. With both keys recovered, the malware regenerates the Secure Preferences integrity material: on Chromium builds prior to v144 it computes legacy HMACs from the seed, and on v144+ it hashes seed+data and encrypts the digest with the recovered OSCrypt key, then overwrites the protection.macs, protection.super_mac, and the per-extension *_encrypted_hash / *_super_encrypted_hash fields. It additionally flips extensions.ui.developer_mode and registers the extension under extensions.settings.<extension_id>, causing Chrome to treat the forged entry as fully trusted on next launch.
The installed extension (masquerading as 'AVSync System Inc', extension ID ndpbidppejfanjbhfgjlohfanbfbklff; earlier campaigns used 'FrameSync Driver/Plugin' and a QR-themed variant) requests tabs, cookies, storage and webRequest permissions and: harvests Login Data/Login Data For Account, Web Data, and Network/Cookies databases; logs keystrokes from all input/textarea elements via a MutationObserver-backed listener; intercepts and redirects HTTP requests using MD5-hashed domain targeting; injects attacker-supplied HTML retrieved from endpoints disguised as CSS files; captures screenshots and up to 1,000 history entries from the last 15 days; and exfiltrates a RC4-encrypted (key = SHA-256 of plaintext) ZIP archive containing a keys.json (both v10 legacy and v20 App-Bound OSCrypt keys) to /api/savecreds and /api/v1/fingerprint. Live command delivery runs over a WebSocket at /google_ws/, polling once per second, alongside HTTP polling at /google_api/ disguised as static asset requests, all payloads lz-string compressed and base64 encoded.
Infrastructure has evolved from static domains (granderevolucao[.]store, cremeb[.]com, lojinhadoluiz[.]online) toward an Ethereum smart-contract dead-drop resolver (most recently 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b) whose setConfig() method stores the current installer URL, extension download location, the SentinelOne decoy binary (JPEG-encoded), and a .NET RunPE sub-module, with prior contracts rotated roughly monthly since May 19, 2026. Timezone clustering of contract transactions (UTC-3, 9am-6pm), Portuguese-language code comments/variable names, and an author email recovered from Internet Archive upload metadata all point to a Brazil-based operator; a possible second operator running a modified toolkit copy (seguranca.versionnova[.]site, token MichelleMignon171) was also observed. Elastic disrupted part of the campaign by registering a canary/kill-switch domain used in the malware's anti-sandbox logic, and reports over 1,515 confirmed infected systems, overwhelmingly in Brazil.
MITRE ATT&CK techniques used in TL-2026-2544
Command and Control
T1008 Fallback Channels; T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1573.001 Symmetric Cryptography
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks; T1574.001 DLL
Persistence
T1053.005 Scheduled Task; T1176 Software Extensions
Credential Access
T1056.001 Keylogging; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Collection
Affected products and versions in KREMLIN Banking Malware Forges Chrome/Edge Secure
- Google — Google Chrome
Vulnerable versions: all versions relying on Secure Preferences HMAC/hash integrity for unmanaged extension trust, including pre-v144 legacy HMAC scheme and v144+ encrypted-hash scheme - Microsoft — Microsoft Edge
Vulnerable versions: Chromium-based Edge builds sharing the same Secure Preferences integrity design as affected Chrome versions
Remediation for KREMLIN Banking Malware Forges Chrome/Edge Secure
Immediate actions
- Block network IOC domains and IPs listed below at proxy/firewall/DNS layer
- Hunt for the scheduled task 'MicrosoftNodeRuntimeUpdater' (also seen as 'AcrobatBrowserExtension') and remove it
- Enumerate installed Chrome/Edge extensions for developer-mode entries and the AVSync/FrameSync extension IDs, then remove and reset affected browser profiles
- Force-rotate credentials and invalidate active sessions for any user whose browser profile shows signs of Secure Preferences tampering
- Flag and quarantine inbound e-mail/messaging attachments named like COMPROVANTE_<Bank>_DD-MM-YYYY.js or similar Portuguese invoice/receipt lures
Workarounds
- Restrict extension installation to browser-managed enterprise policy sources only
- Deploy DNS-layer blocking for newly-registered domains matching the actor's naming conventions
Longer-term hardening
- Enforce Chrome/Edge ExtensionInstallForcelist and ExtensionInstallBlocklist enterprise policies to prevent unmanaged extension installation
- Disable browser Developer Mode via GPO/managed policy (ExtensionInstallSources, DeveloperToolsAvailability)
- Deploy EDR with behavioral detection for chrome.exe launched under a debugger flag and for direct writes to Secure Preferences
- Monitor for DLL side-loading against legitimate security-vendor binaries (e.g., SentinelOne)
- Add Ethereum smart-contract read monitoring for known dead-drop-resolver addresses associated with this actor
Timeline of KREMLIN Banking Malware Forges Chrome/Edge Secure
- Earliest known toolkit activity: an Internet Archive JPEG upload (output_image_202505.jpg) under account 'Radduxx' later found to carry payload configuration
- Codecaudiog A campaign begins, delivering the malicious extension plus PULSAR RAT v1.6.6/1.7.3
- Codecaudiog B campaign observed running in parallel with a distinct customer/config ID
- Acrobat campaign delivers PULSAR RAT v1.7.1/1.7.2 without the browser extension component
- Framesync-branded extension variant first observed hosted via lojinhadoluiz[.]online
- Framesync campaign deploys extension v12.0.0 (extension ID djodclnjknbpambeaaapadmdfhmbpeog) without an accompanying RAT
- Donalurdesconfeitos-Cremeb campaign begins; the 'KREMLIN' branding is introduced into the toolkit for the first time
- A JSE loader file header explicitly credits author 'Kr3mlin4rt1st' and names the toolkit KREMLIN, version 1.33
- Cremeb campaign introduces a QR-code social-engineering lure alongside a QR-themed extension variant and PULSAR RAT v2.4.5
- First Ethereum smart contract dead-drop resolver deployed (0x902EDbFECFF38f285Bf26283fB9cEB3700061873); REMCOS RAT substitutes PULSAR from this point forward
- Operator rotates to a second smart contract (0x4f7D712D0B53fDf3c96896EB411467B30Da23406) for C2 configuration delivery
- Third smart contract rotation (0x64Def0A6099c4DE9C413B108EAae85A3C7457615); a possible second operator running a modified toolkit copy is observed via seguranca.versionnova[.]site (Waves A-C)
- Backup/failover C2 domains volmira[.]site and zaviro[.]online first observed alongside the current smart contract 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b
- Elastic Security Labs (tracking as REF9334) and BleepingComputer publicly disclose the campaign, reporting 1,515+ confirmed infections predominantly in Brazil; Elastic discloses it registered a canary/kill-switch domain to disrupt part of the operation
Sources cited for KREMLIN Banking Malware Forges Chrome/Edge Secure
- Malware bypasses browser checks to force install Chrome, Edge extensions
- The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
- KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
- KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions
- KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension
- KREMLIN malware uses Ethereum to update attack servers
- elastic/labs-releases (public IOC/tooling repository)
More in malware
- MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2
- AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)
- EtherHiding / Blockchain Dead Drops: Nation-State Actors Drive 440% Surge in On-Chain Malware C2
- Iranian State Actors Deploy CHOSEN BRICK Windows Malware to Spy on Dissidents, Activists, and Journalists
- Chosen Brick: Iranian State-Sponsored Windows Surveillance Malware Exposed by US, UK, and Dutch Agencies
Detection coverage for TL-2026-2544
As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2544 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.