INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Malware forces install of Chrome and Edge extensions

| 2026-09-11 18:06 MEDIUM MEDIUM DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
A banking malware operation, linked to a Brazilian entity responsible for at least seven campaigns since May 2025, has been using the KREMLIN toolkit to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data. The infected systems total 1,515, with almost all located in Brazil. After opening a JavaScript file disguised as a bank receipt or document, the malware triggers a fake error while downloading [IOC HIDDEN • LOGIN REQUIRED], establishing persistence through a scheduled task, and retrieving payload locations from Ethereum smart contracts. The malicious extensions bypass browser checks to force install Chrome and Edge extensions without user approval, using a documented technique rarely observed in malware.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 23 IoCs Create Free Account
No•••••.js
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
141c35••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
e17e1e••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
en•••••.cc
pr•••••.net
je•••••.cc
en•••••.cc
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
BR RU
financefinance technologytechnology
Incident Timeline
‎May 2025
Threat actors linked to a Brazilian operation, using lures impersonating 12 banks, targeted users on Twitch with malicious browser extensions that exposed OAuth tokens.
source_region Brazil
Despite the name, KREMLIN is linked to a Brazilian operation responsible for at least seven campaigns since May 2025 that use lures impersonating 12 banks.
general_metric 12 banks
Despite the name, KREMLIN is linked to a Brazilian operation responsible for at least seven campaigns since May 2025 that use lures impersonating 12 banks.
‎mid-2025
Threat actors using the KREMLIN toolkit installed malicious Chrome and Edge extensions on approximately 30,000 users' devices.
organisation KREMLIN
A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.
organisation Chrome and Edge
A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.
‎2026/09/11
Threat actors used a malicious Twitch browser extension called 'Twitch Enhanced Viewer | JeetBot' to capture and forward users' live Twitch OAuth session tokens to Russian-controlled proxy servers.
organisation Russian Bot Service
Malicious Twitch Browser Extension Exposes 30,000 Users' OAuth Tokens to Russian Bot Service.
organisation Twitch Enhanced Viewer
A malicious browser extension called 'Twitch Enhanced Viewer | JeetBot' distributed on Chrome Web Store and Firefox Add-ons captures and forwards users' live Twitch OAuth session tokens to Russian-controlled proxy servers.
organisation JeetBot
A malicious browser extension called 'Twitch Enhanced Viewer | JeetBot' distributed on Chrome Web Store and Firefox Add-ons captures and forwards users' live Twitch OAuth session tokens to Russian-controlled proxy servers.
victims 30,000 Chrome users
The extension, with approximately 30,000 Chrome users and 552 Firefox users, markets itself as a quality-of-life tool for blocking ads and unlocking streams.
victims 552 Firefox users
The extension, with approximately 30,000 Chrome users and 552 Firefox users, markets itself as a quality-of-life tool for blocking ads and unlocking streams.
organisation Ethereum
After passing anti-sandbox checks, the file triggers a fake error while simultaneously downloading Node.js, establishing persistence through a scheduled task, and retrieving the additional payload location from an Ethereum smart contract.
organisation Chromium
Researchers at Elastic Security Labs found that the malicious extensions bypass Chromium’s integrity mechanisms and load in browsers as if they had been approved by the user.
organisation Chromium’s Secure Preferences
Next, it enables developer mode and adds the extension to Chromium’s Secure Preferences.
organisation Secure Preferences
“KREMLIN uses a documented technique rarely observed in malware: it manually copies the extension into the browser's profile directories and registers it in the Secure Preferences file,” Elastic explains .
organisation AVSync
…ese entries with cryptographic integrity checks, the malware must retrieve the required keys and regenerate the associated HMACs and encrypted hashes.” Once installed, the extension masquerades as AVSync and performs the following actions: Steals cookies, local storage, and session storage Keylogs text entered into forms, including passwords Captures screenshots and page source Enumera…
organisation HTML
…entered into forms, including passwords Captures screenshots and page source Enumerates open tabs and browsing history Intercepts HTTP request bodies and headers Injects attacker-controlled HTML into websites Redirects clicks to attacker-selected destinations Receives commands through a WebSocket connection Apart from the malicious extension, the KREMLIN toolkit also acts as an in…
organisation WebSocket
…and browsing history Intercepts HTTP request bodies and headers Injects attacker-controlled HTML into websites Redirects clicks to attacker-selected destinations Receives commands through a WebSocket connection Apart from the malicious extension, the KREMLIN toolkit also acts as an info-stealer that can archive and exfiltrate browser databases, cookies, installed extensions, and the A…
organisation App-Bound
…aders Injects attacker-controlled HTML into websites Redirects clicks to attacker-selected destinations Receives commands through a WebSocket connection Apart from the malicious extension, the KREMLIN toolkit also acts as an info-stealer that can archive and exfiltrate browser databases, cookies, installed extensions, and the App-Bound cryptographic keys needed to decrypt protected data.
organisation Elastic Security Labs
Overview of the REF9334 attack chain Source: Elastic Disrupting the operation Elastic Security Labs researchers found that KREMLIN malware campaigns use Ethereum smart contracts as dead-drop resolvers and also abuse the Internet Archive service to host payloads hidden inside JPEG images.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Tactical Metrics
Metrics
victims
30,000
Chrome Users
The extension, with approximately 30,000 Chrome users and 552 Firefox users, markets itself as a quality-of-life tool for blocking ads and unlocking streams.
Metrics
victims
552
Firefox Users
The extension, with approximately 30,000 Chrome users and 552 Firefox users, markets itself as a quality-of-life tool for blocking ads and unlocking streams.
Intelligence Sources
BleepingComputer 2026-09-16
AlienVault OTX 2026-09-11