The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Opened

elastic.co Nov 6, 2026 vuln malware identity privacy chrome-extension browser cti dlp

Elastic Security Labs tracked this malicious browser extension across seven campaigns and 15 months, through Brazilian bank lures and the Ethereum smart contracts that hold its C2 configuration.

Read at elastic.co ↗

Also covered by

Elastic Security Labs