A malware campaign known as KREMLIN has infected more than 1,500 systems by slipping a malicious browser extension into Chrome and Edge profiles. The extension steals data like passwords, session cookies, open tabs and browser storage, enabling attackers to hijack online accounts without needing login credentials directly. Most of the targets — nearly 99% — are in Brazil.
How the Malware Works
KREMLIN begins with deceptive JavaScript files disguised as bank statements or invoices. When victims open these files, the malware sets off a multi-stage process: it first checks if the environment is a sandbox or analysis tool; then creates a scheduled task to maintain persistence; finally, it fetches infrastructure details from an Ethereum smart contract, enabling dynamic configuration of the attack chain.
Instead of using official browser extension stores, KREMLIN installs itself directly into profile folders for Chrome and Edge. It also alters protected preferences so browsers treat the extension as legitimate and skip regular verification. The extension—posing as “AVSync”—requests sweeping permissions: access to tabs, cookies, storage, network requests, and more. It can snap screenshots, log keystrokes, collect cookies and web data, and even inject malicious content into displayed pages.
Brazil in the Crosshairs
All of KREMLIN’s phishing lures are written in Portuguese and mimic Brazilian financial institutions and instant payment services. The operation has rolled out over seven campaigns across 15 months, with 1,515 systems compromised—98.75% of them in Brazil. The Brazil focus shows in the language, targeted institutions, and infection behavior.
The campaign has evolved over time. Initially it delivered not just browser extensions but remote access tools. Lately it has relied on signed components to load unsigned payloads, blockchain configuration for flexibility, and decoys like payment receipts, invoices, and QR-themed files to trick users. Attackers also hide infection with fake error messages, making it tough for users to detect anything unusual.
What To Do If You’re Affected
Organizations and individuals should treat these threats seriously. Recommended defenses include blocking script or .js files arriving via email, filtering messages that carry deceptive invoice-like attachments, and scrutinizing scheduled tasks and browser profiles for unauthorized changes. Teams should also track behavior—especially anomalous extension installs—rather than relying only on known indicators.
If a device is compromised, isolate it immediately. Remove the malicious extension, reset all passwords from a clean machine, revoke active sessions, and review installed browser extensions for anything unfamiliar—especially those asking for broad permissions. Many attacks like this succeed by abusing the trust we place in browser security mechanisms.
Why it matters: KREMLIN represents a dangerous blend of social engineering and browser-level intrusion. By sidestepping official extension stores and using dynamic infrastructure, it raises the bar for detection and remediation. For Brazil—already frequently targeted—this adds another layer of complexity. Globally, this campaign underscores how browser extensions are becoming a favored vector for credential theft. Companies must adapt: prevention, detection, and incident response all need to evolve in lockstep with threats like KREMLIN.
