Threat reportMalwareTL-2026-2544
KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious 'AVSync' Extension
A Brazilian cybercriminal operation (Elastic tracking designation REF9334) is distributing a multi-stage banking trojan toolkit called KREMLIN that manually recomputes the HMAC and encrypted-hash integrity values inside Chrome/Edge's Secure Preferences file, letting it silently register a malicious extension disguised as 'AVSync' without tripping the browser's unauthorized-extension protections.
Key facts for KREMLIN AVSync browser extension
| Identifiers | TL-2026-2544 |
|---|---|
| Also known as | CHROMEBALLRAT (earlier campaign name) |
| Severity | HIGH |
| Exploitation status | Exploited in the wild |
| Affected products | Google Google Chrome; Microsoft Microsoft Edge |
| Attribution | REF9334 (medium confidence) |
| Malware | KREMLIN, PULSAR, Pulsar RAT, REMCOS |
| MITRE ATT&CK techniques | T1008 Fallback Channels, T1027 Obfuscated Files or Information, T1036.005 Match Legitimate Resource Name or Location, T1053.005 Scheduled Task, T1056.001 Keylogging, T1059.001 PowerShell, T1059.007 JavaScript, T1071.001 Web Protocols, T1102.001 Dead Drop Resolver, T1113 Screen Capture, T1176 Software Extensions, T1185 Browser Session Hijacking and 6 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | finance, banking, payments |
| Target regions | brazil, 005 - South America |
| Detection rules | 9 (1 shown free) |
| Sources | 7 cited sources |
Detection coverage for KREMLIN AVSync browser extension
As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2544 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: KREMLIN WebSocket/HTTP C2 Beacon and RC4 Credential-ZIP Exfiltration
Detects network connections to the known KREMLIN C2 IP/domain set and the documented C2 URI patterns — the /google_ws/ WebSocket command channel (1-second poll), /google_api/ HTTP polling disguised as static-asset requests, and the /api/savecreds and /api/v1/fingerprint exfiltration endpoints that receive the RC4-encrypted keys.json/credential ZIP.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1102.001, T1071.001, T1573.001, T1008, T1539, T1555.003
- Data sources: proxy, zscaler, palo_alto_traffic, dns
- Severity: critical
- Confidence: high
Splunk SPL
index=proxy (sourcetype="stream:http" OR sourcetype="pan:traffic" OR sourcetype="zscaler:web")
(dest_ip IN ("185.221.23.133","144.172.112.239","45.90.13.210","37.16.74.100","178.92.162.38","209.99.185.204"))
OR match(url, "(?i)(/google_ws/|/google_api/|/api/savecreds|/api/v1/fingerprint)")
OR match(dest_host, "(?i)(granderevolucao\.store|volmira\.site|zaviro\.online|cremeb\.com|connection\.upgradeonline\.site|lojinhadoluiz\.online|seguranca\.versionnova\.site|acrobat-updater\.com)")
| stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(dest_port) as ports by src_ip, dest_ip, dest_host
| sort -last_seenMicrosoft KQL
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP in ("185.221.23.133","144.172.112.239","45.90.13.210","37.16.74.100","178.92.162.38","209.99.185.204")
or RemoteUrl has_any ("/google_ws/", "/google_api/", "/api/savecreds", "/api/v1/fingerprint")
or RemoteUrl has_any ("granderevolucao.store","volmira.site","zaviro.online","cremeb.com","connection.upgradeonline.site","lojinhadoluiz.online","seguranca.versionnova.site","acrobat-updater.com")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| sort by Timestamp descSigma
title: KREMLIN WebSocket/HTTP C2 Beacon and Credential-ZIP Exfiltration
id: b5c6d7e8-9f0a-4b1c-8d2e-3f4a5b6c7d89
status: experimental
description: Detects HTTP/WebSocket traffic to known KREMLIN C2 infrastructure and the documented /google_ws/, /google_api/, /api/savecreds, and /api/v1/fingerprint URI paths used for command polling and RC4-encrypted credential-ZIP exfiltration.
references:
- https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware
- https://crypto.news/kremlin-malware-uses-ethereum-to-update-attack-servers/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-16
tags:
- attack.command_and_control
- attack.t1102.001
- attack.t1071.001
- attack.t1573.001
- attack.t1008
- attack.credential_access
- attack.t1539
- attack.t1555.003
- attack.tool.kremlin
logsource:
category: proxy
detection:
selection_uri:
c-uri|contains:
- '/google_ws/'
- '/google_api/'
- '/api/savecreds'
- '/api/v1/fingerprint'
selection_domain:
c-uri|contains:
- 'granderevolucao.store'
- 'volmira.site'
- 'zaviro.online'
- 'cremeb.com'
- 'connection.upgradeonline.site'
- 'lojinhadoluiz.online'
- 'seguranca.versionnova.site'
- 'acrobat-updater.com'
condition: 1 of selection_*
falsepositives:
- Extremely low; these are actor-registered domains and non-standard URI paths not used by legitimate Google services
level: criticalKnown false positives:
- Extremely low; /google_ws/ and /google_api/ are actor-chosen disguise paths, not genuine Google infrastructure — verify dest_ip/dest_host does not resolve to a legitimate Google ASN before dismissing
Tuning notes: Refresh the IP/domain lists on a short cycle — KREMLIN's smart-contract dead-drop resolver rotates the active installer/extension URLs roughly monthly and prior static domains still appear in older infections; add the current dead-drop contract address to a separate blockchain-read monitor rather than this network rule.
- Node.js Runtime Silent Download Chained from Script-Host Lure Execution · unlock with TL Creds
- Chrome/Edge Developer-Mode Flip Combined with Unmanaged Extension Registration · unlock with TL Creds
- Ethereum Smart-Contract Dead-Drop Resolver Lookup from Endpoint Process · unlock with TL Creds
- KREMLIN Invoice-Lure Script Execution and Sandbox-Check Chain · unlock with TL Creds
- KREMLIN Secure Preferences Integrity-Material Forgery (Write to Chrome/Edge Secure Preferences) · unlock with TL Creds
- KREMLIN Known-Bad C2 Infrastructure Connection (Static IOC Match) · unlock with TL Creds
- Portuguese Invoice-Lure JScript Execution via wscript/cscript (KREMLIN Initial Access) · unlock with TL Creds
- MicrosoftNodeRuntimeUpdater Scheduled-Task Persistence, Secure Preferences Tamper, and SentinelOne DLL Side-Load · unlock with TL Creds
Indicators of compromise for KREMLIN AVSync browser extension
As of 2026-09-16, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2544.
Sample indicators (3 of 24)
- IP address:
185.221.23[.]133 - Domain:
granderevolucao[.]store - File hash:
106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42
Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.
How KREMLIN AVSync browser extension works
The extension steals cookies, session/local storage, browser credentials, form input, screenshots and page content, and reports to a WebSocket/HTTP C2 that KREMLIN increasingly resolves via an Ethereum smart-contract dead drop.
KREMLIN is a Brazilian banking-malware toolkit, first observed in the wild around May 21, 2025 and formally branded 'KREMLIN' (author handle Kr3mlin4rt1st, v1.33+) in a JSE file header dated February 8, 2026. Elastic Security Labs, tracking the cluster as REF9334, documents seven distinct campaigns spanning 15+ months (Codecaudiog A/B, Acrobat, Framesync, Donalurdesconfeitos-Cremeb, Cremeb, and an ongoing 'Ethereum Transition' wave), all delivered via JavaScript files disguised as invoices, receipts, or payment confirmations impersonating 12 Brazilian banks and payment platforms (Banco do Brasil, Caixa, Bradesco, Sicoob, C6 Bank, Inter, BTG Pactual, Safra, PagBank, PicPay, Santander, Mercado Pago).
After the initial JavaScript stage performs basic obfuscation and sandbox/VM checks, it downloads a Node.js runtime and establishes persistence via a scheduled task ('MicrosoftNodeRuntimeUpdater', triggered at logon and every 30 minutes) that resolves further configuration through an Ethereum smart contract used as a dead-drop resolver. A C++ installer (~2.10MB, x64) is then delivered via DLL side-loading against a legitimate SentinelOne binary, which drops the final payload: the malicious Chrome/Edge extension plus either the PULSAR RAT (v1.6.6-2.4.5) or, from May 2026 onward, REMCOS RAT.
The extension-installation technique is the novel core of this threat: rather than relying on a known Chromium vulnerability, the installer extracts the legacy OSCrypt key from Chrome's Local State file (stripping the 5-byte DPAPI prefix and calling CryptUnprotectData), then launches Chrome under a debugger with --no-startup-window to intercept the LOAD_DLL_DEBUG_EVENT for chrome.dll, scans its .rdata section for the string 'OSCrypt.AppBoundProvider.Decrypt.ResultCode', and uses RIP-relative LEA instruction pattern matching to recover the App-Bound encryption key directly from process memory, together with a seed pulled from the browser's resources.pak. With both keys recovered, the malware regenerates the Secure Preferences integrity material: on Chromium builds prior to v144 it computes legacy HMACs from the seed, and on v144+ it hashes seed+data and encrypts the digest with the recovered OSCrypt key, then overwrites the protection.macs, protection.super_mac, and the per-extension *_encrypted_hash / *_super_encrypted_hash fields. It additionally flips extensions.ui.developer_mode and registers the extension under extensions.settings.<extension_id>, causing Chrome to treat the forged entry as fully trusted on next launch.
The installed extension (masquerading as 'AVSync System Inc', extension ID ndpbidppejfanjbhfgjlohfanbfbklff; earlier campaigns used 'FrameSync Driver/Plugin' and a QR-themed variant) requests tabs, cookies, storage and webRequest permissions and: harvests Login Data/Login Data For Account, Web Data, and Network/Cookies databases; logs keystrokes from all input/textarea elements via a MutationObserver-backed listener; intercepts and redirects HTTP requests using MD5-hashed domain targeting; injects attacker-supplied HTML retrieved from endpoints disguised as CSS files; captures screenshots and up to 1,000 history entries from the last 15 days; and exfiltrates a RC4-encrypted (key = SHA-256 of plaintext) ZIP archive containing a keys.json (both v10 legacy and v20 App-Bound OSCrypt keys) to /api/savecreds and /api/v1/fingerprint. Live command delivery runs over a WebSocket at /google_ws/, polling once per second, alongside HTTP polling at /google_api/ disguised as static asset requests, all payloads lz-string compressed and base64 encoded.
Infrastructure has evolved from static domains (granderevolucao[.]store, cremeb[.]com, lojinhadoluiz[.]online) toward an Ethereum smart-contract dead-drop resolver (most recently 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b) whose setConfig() method stores the current installer URL, extension download location, the SentinelOne decoy binary (JPEG-encoded), and a .NET RunPE sub-module, with prior contracts rotated roughly monthly since May 19, 2026. Timezone clustering of contract transactions (UTC-3, 9am-6pm), Portuguese-language code comments/variable names, and an author email recovered from Internet Archive upload metadata all point to a Brazil-based operator; a possible second operator running a modified toolkit copy (seguranca.versionnova[.]site, token MichelleMignon171) was also observed. Elastic disrupted part of the campaign by registering a canary/kill-switch domain used in the malware's anti-sandbox logic, and reports over 1,515 confirmed infected systems, overwhelmingly in Brazil.
MITRE ATT&CK techniques by tactic:
Command and Control
T1008 Fallback Channels; T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1573.001 Symmetric Cryptography
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks; T1574.001 DLL
Persistence
T1053.005 Scheduled Task; T1176 Software Extensions
Credential Access
T1056.001 Keylogging; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
Collection
Remediation for KREMLIN AVSync browser extension
Immediate actions
- Block network IOC domains and IPs listed below at proxy/firewall/DNS layer
- Hunt for the scheduled task 'MicrosoftNodeRuntimeUpdater' (also seen as 'AcrobatBrowserExtension') and remove it
- Enumerate installed Chrome/Edge extensions for developer-mode entries and the AVSync/FrameSync extension IDs, then remove and reset affected browser profiles
- Force-rotate credentials and invalidate active sessions for any user whose browser profile shows signs of Secure Preferences tampering
- Flag and quarantine inbound e-mail/messaging attachments named like COMPROVANTE_<Bank>_DD-MM-YYYY.js or similar Portuguese invoice/receipt lures
Workarounds
- Restrict extension installation to browser-managed enterprise policy sources only
- Deploy DNS-layer blocking for newly-registered domains matching the actor's naming conventions
Longer-term hardening
- Enforce Chrome/Edge ExtensionInstallForcelist and ExtensionInstallBlocklist enterprise policies to prevent unmanaged extension installation
- Disable browser Developer Mode via GPO/managed policy (ExtensionInstallSources, DeveloperToolsAvailability)
- Deploy EDR with behavioral detection for chrome.exe launched under a debugger flag and for direct writes to Secure Preferences
- Monitor for DLL side-loading against legitimate security-vendor binaries (e.g., SentinelOne)
- Add Ethereum smart-contract read monitoring for known dead-drop-resolver addresses associated with this actor
Affected and fixed versions
- Google — Google Chrome
Vulnerable versions: all versions relying on Secure Preferences HMAC/hash integrity for unmanaged extension trust, including pre-v144 legacy HMAC scheme and v144+ encrypted-hash scheme - Microsoft — Microsoft Edge
Vulnerable versions: Chromium-based Edge builds sharing the same Secure Preferences integrity design as affected Chrome versions
Timeline of KREMLIN AVSync browser extension
- Earliest known toolkit activity: an Internet Archive JPEG upload (output_image_202505.jpg) under account 'Radduxx' later found to carry payload configuration
- Codecaudiog A campaign begins, delivering the malicious extension plus locked-ioc-23 RAT v1.6.6/1.7.3
- Codecaudiog B campaign observed running in parallel with a distinct customer/config ID
- Acrobat campaign delivers locked-ioc-23 RAT v1.7.1/1.7.2 without the browser extension component
- Framesync-branded extension variant first observed hosted via locked-ioc-11
- Framesync campaign deploys extension v12.0.0 (extension ID djodclnjknbpambeaaapadmdfhmbpeog) without an accompanying RAT
- Donalurdesconfeitos-Cremeb campaign begins; the 'locked-ioc-22' branding is introduced into the toolkit for the first time
- A JSE loader file header explicitly credits author 'Kr3mlin4rt1st' and names the toolkit locked-ioc-22, version 1.33
- Cremeb campaign introduces a QR-code social-engineering lure alongside a QR-themed extension variant and locked-ioc-23 RAT v2.4.5
- First Ethereum smart contract dead-drop resolver deployed (0x902EDbFECFF38f285Bf26283fB9cEB3700061873); locked-ioc-24 RAT substitutes locked-ioc-23 from this point forward
- Operator rotates to a second smart contract (0x4f7D712D0B53fDf3c96896EB411467B30Da23406) for C2 configuration delivery
- Third smart contract rotation (0x64Def0A6099c4DE9C413B108EAae85A3C7457615); a possible second operator running a modified toolkit copy is observed via locked-ioc-9 (Waves A-C)
- Backup/failover C2 domains locked-ioc-18 and locked-ioc-16 first observed alongside the current smart contract locked-ioc-6
- Elastic Security Labs (tracking as REF9334) and BleepingComputer publicly disclose the campaign, reporting 1,515+ confirmed infections predominantly in Brazil; Elastic discloses it registered a canary/kill-switch domain to disrupt part of the operation
Sources cited for KREMLIN AVSync browser extension
- The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions elastic.co · Research · 2026-09-16
- elastic/labs-releases (public IOC/tooling repository) GitHub · Code repository · 2026-09-16
- Malware bypasses browser checks to force install Chrome, Edge extensions BleepingComputer · News · 2026-09-16
- KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens The Hacker News · News · 2026-09-16
- KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions gbhackers.com · News · 2026-09-16
- KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension cybersecuritynews.com · News · 2026-09-16
- KREMLIN malware uses Ethereum to update attack servers crypto.news · News · 2026-09-16
More from REF9334
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.
