A new malware has appeared, and it actually bypasses browser checks and force installs Chrome and Edge extensions. The malware in question is called ‘KREMLIN’, and it has been active since mid-2025.
A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.
Hosted on MSN
Chrome and Edge browsers hijacked by KREMLIN malware for credential and token session theft
Elastic Security Labs uncovered REF9334, a Brazilian banking malware campaign active since May 2025 Malware “Kremlin” deploys fake docs and malicious Chrome/Edge extensions to steal banking data 1,515 ...
The KREMLIN malware has been targeting users since mid-2025, using fake financial documents to infect systems and forcibly install malicious Chrome and Edge extensions. The extensions can steal ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results