#ParsedReport #CompletenessHigh
17-09-2026

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware

Report completeness: High

Actors/Campaigns:
Kr3mlin4rt1st

Threats:
Dead_drop_technique
Process_injection_technique
Runpe_tool
Api_obfuscation_technique
Deadlock
Remcos_rat
Pulsar_rat
Donut
Chromeballrat
Dll_sideloading_technique
Steganography_technique

Victims:
Banking users, Financial institutions

Industry:
Financial

Geo:
Finland, Brazil, Canada, Brasil, Portuguese, United states, Switzerland, Germany, Russia, Brazilian, Netherlands

TTPs:
Tactics: 9
Technics: 0

IOCs:
Hash: 8
Url: 21
Path: 3
Coin: 20
File: 104
Email: 1
Domain: 18
IP: 25
BrowserExtension: 2

Soft:
Chrome, Chromium, Node.js, VirtualBox, vmmemctl, VBoxGuest, Google Chrome, flask, js) → Run, ode.js →, have more...

Crypto:
ethereum

Algorithms:
hmac, sha256, zip, md5, rc4, base64

Functions:
GetSyscallNumber, SetName, setConfig, getConfig

Win API:
Popup, CreateThread, LdrLockLiberator, ZwQuerySystemInformation, GetUserNameW, ZwQueryAttributesFile, GetLastInputInfo, TerminateProcess, CryptUnprotectData, ReadProcessMemory, have more...

Win Services:
VGAuthService

Languages:
php, javascript, powershell

Platforms:
x64

Links:
https://github.com/ElliotKillick/LdrLockLiberator
have more...
https://github.com/elastic/labs-releases/tree/main/indicators/kremlin
https://github.com/evilashz/PigSyscall