# KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious 'AVSync' Extension

> A Brazilian cybercriminal operation (Elastic tracking designation REF9334) is distributing a multi-stage banking trojan toolkit called KREMLIN that manually recomputes the HMAC and encrypted-hash integrity values inside Chrome/Edge's Secure Preferences file, letting it silently register a malicious extension disguised as 'AVSync' without tripping the browser's unauthorized-extension protections. The extension steals cookies, session/local storage, browser credentials, form input, screenshots and page content, and reports to a WebSocket/HTTP C2 that KREMLIN increasingly resolves via an Ethereum smart-contract dead drop.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2544
- **ID:** TL-2026-2544
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** REF9334
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

KREMLIN is a Brazilian banking-malware toolkit, first observed in the wild around May 21, 2025 and formally branded 'KREMLIN' (author handle Kr3mlin4rt1st, v1.33+) in a JSE file header dated February 8, 2026. Elastic Security Labs, tracking the cluster as REF9334, documents seven distinct campaigns spanning 15+ months (Codecaudiog A/B, Acrobat, Framesync, Donalurdesconfeitos-Cremeb, Cremeb, and an ongoing 'Ethereum Transition' wave), all delivered via JavaScript files disguised as invoices, receipts, or payment confirmations impersonating 12 Brazilian banks and payment platforms (Banco do Brasil, Caixa, Bradesco, Sicoob, C6 Bank, Inter, BTG Pactual, Safra, PagBank, PicPay, Santander, Mercado Pago).

After the initial JavaScript stage performs basic obfuscation and sandbox/VM checks, it downloads a Node.js runtime and establishes persistence via a scheduled task ('MicrosoftNodeRuntimeUpdater', triggered at logon and every 30 minutes) that resolves further configuration through an Ethereum smart contract used as a dead-drop resolver. A C++ installer (~2.10MB, x64) is then delivered via DLL side-loading against a legitimate SentinelOne binary, which drops the final payload: the malicious Chrome/Edge extension plus either the PULSAR RAT (v1.6.6-2.4.5) or, from May 2026 onward, REMCOS RAT.

The extension-installation technique is the novel core of this threat: rather than relying on a known Chromium vulnerability, the installer extracts the legacy OSCrypt key from Chrome's Local State file (stripping the 5-byte DPAPI prefix and calling CryptUnprotectData), then launches Chrome under a debugger with --no-startup-window to intercept the LOAD_DLL_DEBUG_EVENT for chrome.dll, scans its .rdata section for the string 'OSCrypt.AppBoundProvider.Decrypt.ResultCode', and uses RIP-relative LEA instruction pattern matching to recover the App-Bound encryption key directly from process memory, together with a seed pulled from the browser's resources.pak. With both keys recovered, the malware regenerates the Secure Preferences integrity material: on Chromium builds prior to v144 it computes legacy HMACs from the seed, and on v144+ it hashes seed+data and encrypts the digest with the recovered OSCrypt key, then overwrites the protection.macs, protection.super_mac, and the per-extension *_encrypted_hash / *_super_encrypted_hash fields. It additionally flips extensions.ui.developer_mode and registers the extension under extensions.settings.<extension_id>, causing Chrome to treat the forged entry as fully trusted on next launch.

The installed extension (masquerading as 'AVSync System Inc', extension ID ndpbidppejfanjbhfgjlohfanbfbklff; earlier campaigns used 'FrameSync Driver/Plugin' and a QR-themed variant) requests tabs, cookies, storage and webRequest permissions and: harvests Login Data/Login Data For Account, Web Data, and Network/Cookies databases; logs keystrokes from all input/textarea elements via a MutationObserver-backed listener; intercepts and redirects HTTP requests using MD5-hashed domain targeting; injects attacker-supplied HTML retrieved from endpoints disguised as CSS files; captures screenshots and up to 1,000 history entries from the last 15 days; and exfiltrates a RC4-encrypted (key = SHA-256 of plaintext) ZIP archive containing a keys.json (both v10 legacy and v20 App-Bound OSCrypt keys) to /api/savecreds and /api/v1/fingerprint. Live command delivery runs over a WebSocket at /google_ws/, polling once per second, alongside HTTP polling at /google_api/ disguised as static asset requests, all payloads lz-string compressed and base64 encoded.

Infrastructure has evolved from static domains (granderevolucao[.]store, cremeb[.]com, lojinhadoluiz[.]online) toward an Ethereum smart-contract dead-drop resolver (most recently 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b) whose setConfig() method stores the current installer URL, extension download location, the SentinelOne decoy binary (JPEG-encoded), and a .NET RunPE sub-module, with prior contracts rotated roughly monthly since May 19, 2026. Timezone clustering of contract transactions (UTC-3, 9am-6pm), Portuguese-language code comments/variable names, and an author email recovered from Internet Archive upload metadata all point to a Brazil-based operator; a possible second operator running a modified toolkit copy (seguranca.versionnova[.]site, token MichelleMignon171) was also observed. Elastic disrupted part of the campaign by registering a canary/kill-switch domain used in the malware's anti-sandbox logic, and reports over 1,515 confirmed infected systems, overwhelmingly in Brazil.

## MITRE ATT&CK

- T1059.007 JavaScript
- T1059.001 PowerShell
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1176 Software Extensions
- T1574.001 DLL
- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.001 Keylogging
- T1185 Browser Session Hijacking
- T1113 Screen Capture
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1008 Fallback Channels

## Sources

- [Malware bypasses browser checks to force install Chrome, Edge extensions](https://www.bleepingcomputer.com/news/security/malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions/)
- [The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions](https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware)
- [KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens](https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html)
- [KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions](https://gbhackers.com/kremlin-banking-malware/)
- [KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension](https://cybersecuritynews.com/kremlin-banking-malware/)
- [KREMLIN malware uses Ethereum to update attack servers](https://crypto.news/kremlin-malware-uses-ethereum-to-update-attack-servers/)
- [elastic/labs-releases (public IOC/tooling repository)](https://github.com/elastic/labs-releases)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2544