Skip to content
CertGPS

KREMLIN Malware Campaign

A banking malware operation, active since mid-2025, has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.

Severity awaiting reviewSupply chainMalware
Incident date
Published
Read time
8 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

View source
On this page

Note: This analysis is based on publicly available information from source article. Facts are clearly separated from technical analysis.

Executive Summary

The KREMLIN malware campaign is a critical incident that started in mid-2025 and was disrupted by Elastic Security Labs researchers on September 16, 2026. The operation affected at least 12 banks and 1,515 devices, making it a significant threat to global cybersecurity. The malware uses a toolkit to install malicious Chrome and Edge extensions, bypassing Chromium's integrity mechanisms and loading in browsers as if they had been approved by the user. This incident highlights the importance of supply-chain security and the need for robust threat detection and response mechanisms.

The KREMLIN malware campaign is a prime example of how sophisticated and well-organized threat actors can compromise even the most secure systems. The use of Ethereum smart contracts as dead-drop resolvers and the abuse of the Internet Archive service to host payloads hidden inside JPEG images demonstrate the creativity and resourcefulness of the attackers. This incident serves as a wake-up call for security professionals to stay vigilant and proactive in their threat detection and response efforts.

What Happened: Timeline

✅ Verified Facts

TimeEvent
Mid-2025KREMLIN malware operation started
September 16, 2026Elastic Security Labs researchers found the malware and disrupted the current campaign

Technical Deep Dive

Understanding Node.js

What is it?

Node.js is a JavaScript runtime environment that allows developers to run JavaScript on the server-side. It is designed to handle high-performance, real-time web applications and is widely used in modern web development. Node.js uses an event-driven, non-blocking I/O model that makes it highly scalable and efficient.

How does it work?

Node.js uses an event loop to handle incoming requests and send responses. It uses a concept called "callbacks" to handle asynchronous operations, allowing developers to write non-blocking code that can handle multiple requests concurrently. Node.js also provides a wide range of built-in modules and libraries that make it easy to perform tasks such as file I/O, network communication, and database interactions.

Security considerations

Node.js is a powerful tool that can be used to build secure and scalable web applications. However, it also introduces new security risks, such as the potential for buffer overflows and memory leaks. Additionally, Node.js's event-driven model can make it difficult to detect and respond to security threats in real-time. In the context of the KREMLIN malware campaign, Node.js was used to establish persistence through a scheduled task and retrieve the additional payload location from an Ethereum smart contract.

Understanding Chromium's Integrity Mechanisms

What is it?

Chromium's integrity mechanisms are a set of security features that prevent malicious extensions from being installed or executed in the browser. These mechanisms include the use of cryptographic integrity checks to verify the authenticity of extensions and the Secure Preferences file to store sensitive data.

How does it work?

Chromium's integrity mechanisms use a combination of cryptographic hashes and digital signatures to verify the authenticity of extensions. When an extension is installed, Chromium generates a unique hash for the extension's code and stores it in the Secure Preferences file. When the browser starts, it checks the hash against the stored value to ensure that the extension has not been tampered with.

Security considerations

Chromium's integrity mechanisms are a critical component of the browser's security architecture. However, they can be bypassed by sophisticated threat actors who use techniques such as code obfuscation and anti-debugging to evade detection. In the context of the KREMLIN malware campaign, the attackers used a documented technique to manually copy the extension into the browser's profile directories and register it in the Secure Preferences file.

Understanding Ethereum Smart Contracts

What is it?

Ethereum smart contracts are self-executing contracts with the terms of the agreement written directly into lines of code. They are stored and replicated on a blockchain, allowing for secure, transparent, and tamper-proof execution.

How does it work?

Ethereum smart contracts are written in a high-level programming language called Solidity and are compiled into bytecode that is executed on the Ethereum Virtual Machine (EVM). When a contract is deployed, it is stored on the blockchain and can be executed by anyone with access to the contract's address.

Security considerations

Ethereum smart contracts are a powerful tool for building secure and decentralized applications. However, they also introduce new security risks, such as the potential for smart contract vulnerabilities and the use of smart contracts for malicious purposes. In the context of the KREMLIN malware campaign, the attackers used Ethereum smart contracts as dead-drop resolvers to retrieve the additional payload location.

Analysis: What Went Wrong

📊 Professional Analysis

Technical Root Cause

The technical root cause of the KREMLIN malware campaign was the use of a documented technique to bypass Chromium's integrity mechanisms and install malicious extensions. This technique involved manually copying the extension into the browser's profile directories and registering it in the Secure Preferences file.

Contributing Factors

The contributing factors to the KREMLIN malware campaign included the use of Node.js to establish persistence and retrieve the additional payload location from an Ethereum smart contract. Additionally, the attackers used the Internet Archive service to host payloads hidden inside JPEG images, making it difficult to detect and respond to the threat.

Lessons for Security Professionals

Key Takeaways

  1. Supply-chain security is critical: The KREMLIN malware campaign highlights the importance of supply-chain security and the need for robust threat detection and response mechanisms.
  2. Threat actors are sophisticated: The attackers used a documented technique to bypass Chromium's integrity mechanisms and install malicious extensions, demonstrating their sophistication and resourcefulness.
  3. Security professionals must stay vigilant: The KREMLIN malware campaign serves as a wake-up call for security professionals to stay vigilant and proactive in their threat detection and response efforts.

Prevention & Detection

How to Prevent

  • Implement robust threat detection and response mechanisms: Security professionals must stay vigilant and proactive in their threat detection and response efforts.
  • Use secure coding practices: Developers must use secure coding practices to prevent vulnerabilities in their code.
  • Regularly update and patch software: Regularly updating and patching software can help prevent exploitation of known vulnerabilities.

How to Detect

  • Monitor for suspicious activity: Security professionals must monitor for suspicious activity and respond quickly to potential threats.
  • Use threat intelligence: Threat intelligence can help security professionals stay ahead of emerging threats and detect potential attacks.
  • Implement anomaly detection: Anomaly detection can help identify potential threats that may not be detected by traditional threat detection mechanisms.
View related certification topics

Security+

  • Threat detection and response: Security+ covers the importance of threat detection and response in preventing and mitigating security threats.
  • Secure coding practices: Security+ covers the importance of secure coding practices in preventing vulnerabilities in code.
  • Supply-chain security: Security+ covers the importance of supply-chain security in preventing and mitigating security threats.

CEH

  • Threat analysis: CEH covers the importance of threat analysis in identifying and mitigating security threats.
  • Vulnerability exploitation: CEH covers the importance of vulnerability exploitation in identifying and mitigating security threats.
  • Penetration testing: CEH covers the importance of penetration testing in identifying and mitigating security threats.

CISSP

  • Threat management: CISSP covers the importance of threat management in preventing and mitigating security threats.
  • Secure coding practices: CISSP covers the importance of secure coding practices in preventing vulnerabilities in code.
  • Supply-chain security: CISSP covers the importance of supply-chain security in preventing and mitigating security threats.

OSCP

  • Threat detection and response: OSCP covers the importance of threat detection and response in preventing and mitigating security threats.
  • Vulnerability exploitation: OSCP covers the importance of vulnerability exploitation in identifying and mitigating security threats.
  • Penetration testing: OSCP covers the importance of penetration testing in identifying and mitigating security threats.

CISM

  • Information security governance: CISM covers the importance of information security governance in preventing and mitigating security threats.
  • Risk management: CISM covers the importance of risk management in preventing and mitigating security threats.
  • Supply-chain security: CISM covers the importance of supply-chain security in preventing and mitigating security threats.

CISM

  • Information security governance: CISM covers the importance of information security governance in preventing and mitigating security threats.
  • Risk management: CISM covers the importance of risk management in preventing and mitigating security threats.
  • Supply-chain security: CISM covers the importance of supply-chain security in preventing and mitigating security threats.

Source (1)

This analysis is based on: https://www.bleepingcomputer.com/news/security/malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions/

This incident analysis is provided for educational purposes. Facts are cited from the source article, while technical analysis represents professional interpretation.