[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9ImkePxCU0VKaPuAn_-FC9Dc1MQd8hWm7pF9U_IBfbo":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"15d8084c-691f-4c08-a48a-3d548ca2eee1","Malware bypasses browser checks to force install Chrome, Edge extensions","malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions-7eb18c","A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data. [...]","A banking malware operation, active since mid-2025 and known as KREMLIN, is installing malicious Chrome and Edge extensions that steal credentials and sensitive data. The malware bypasses browser integrity checks by manually copying extensions into profile directories and re-enabling security mechanisms, making them appear legitimate. The operation, linked to Brazil, uses Ethereum smart contracts and the Internet Archive for payload hosting.","KREMLIN malware uses a toolkit to force install malicious Chrome\u002FEdge extensions.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmalware-bypasses-browser-checks-to-force-install-chrome-edge-extensions\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F12\u002F01\u002Fedge-chrome-buttons.jpg","2026-09-16T18:50:53+00:00","2026-09-16T20:00:09.673238+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"KREMLIN","threat_actor",{"name":21,"type":22},"Chrome","product",{"name":24,"type":22},"Edge",{"name":26,"type":27},"Node.js","technology",{"name":29,"type":27},"Ethereum",{"name":31,"type":22},"REMCOS","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,58,60],{"type":36,"value":18,"context":57},"Toolkit used to install malicious browser extensions.",{"type":36,"value":31,"context":59},"Remote access tool deployed in recent KREMLIN campaigns.",{"type":36,"value":61,"context":62},"Pulsar RAT","Remote access tool used in past KREMLIN operations.",[21,31],{"controls":65,"vendors":149},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":125,"name":126,"problem":127,"products":128},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[129,136,143],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":125,"product_name":133,"url":134,"description":135},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":137,"product_name":140,"url":141,"description":142},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":144,"product_name":145,"url":147,"description":148},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[150,156,162],{"slug":151,"name":152,"logo_path":153,"roles":154},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png",[155],"reported_by",{"slug":157,"name":158,"logo_path":159,"roles":160},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[161],"affected",{"slug":80,"name":81,"logo_path":82,"roles":163},[161],{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":180},"kremlin-banking-malware-forces-malicious-browser-extensions-by-bypassing-integrity-checks","KREMLIN Banking Malware Forces Malicious Browser Extensions by Bypassing Integrity Checks","The KREMLIN banking malware operation exploits a gap in browser security by directly writing malicious extensions into browser profile directories, then re-enabling native security mechanisms so the extensions appear trusted and legitimate. This technique circumvents built-in browser integrity checks that most users and security tools rely on as a last line of defense. The use of decentralized infrastructure—Ethereum smart contracts and the Internet Archive—makes takedowns significantly harder, prolonging victim exposure. This matters because credential-stealing extensions operate silently inside trusted browser sessions, giving attackers access to banking credentials, session tokens, and sensitive form data without triggering traditional endpoint alerts.",[169,170,171,172,173,174,175,176,177,178,179],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF DE.CM-4: Malicious Code Detection","GDPR Article 32: Security of Processing (credential theft leads to personal data breach)","MITRE ATT&CK T1176: Browser Extensions","MITRE ATT&CK T1539: Steal Web Session Cookie",{}]