The KREMLIN malware, of Russian origin, has recently made headlines due to its ability to hijack user sessions on Chrome and Edge. By bypassing Chromium’s security mechanisms, this malicious software installs a rogue extension that steals cookies, passwords, and session tokens. The details of this threat and its implications on cybersecurity are explored below.
Key Takeaways
- KREMLIN uses a rogue extension to hijack Chrome and Edge sessions.
- The malware bypasses Chromium’s integrity controls to go unnoticed.
- The KREMLIN campaign has primarily targeted Brazil, with over 1,500 systems infected.
You are sitting in front of your computer, quietly browsing the web, unaware that malware could hack your bank accounts. Imagine that a simple browser extension, invisible to your eyes, could collect your personal information and hijack your sessions. This is exactly what KREMLIN does, a sophisticated malware targeting Chrome and Edge users. Discover how this threat operates and what you can do to protect yourself.
KREMLIN and the Attack on Chrome and Edge Browsers
Chaque semaine, nous sélectionnons les solutions les plus utiles pour les professionnels du digital : IA, productivité, marketing, création de contenu et business. Voici les outils que nous recommandons actuellement.
☁️ pCloud – Le stockage cloud sécurisé avec une offre à vie.
Sauvegardez vos fichiers, photos et documents importants avec plusieurs centaines de Go ou plusieurs To disponibles.
→ Découvrir l'offre pCloud
🛒 Shopify – Créez votre boutique e-commerce sans coder.
Une solution complète pour lancer, gérer et développer votre activité en ligne.
→ Tester Shopify gratuitement
🤖 Jasper – L'assistant IA pour accélérer votre marketing.
Création de contenus, campagnes publicitaires et idées marketing : gagnez du temps grâce à l'intelligence artificielle.
→ Découvrir Jasper
🎬 CapCut Pro – Le montage vidéo dopé à l'IA.
Créez rapidement des vidéos professionnelles avec des outils avancés et automatisés.
→ Tester CapCut Pro
📊 HubSpot CRM – Le CRM idéal pour structurer votre croissance.
Gérez vos prospects, vos ventes et vos campagnes marketing depuis une seule plateforme.
→ Découvrir HubSpot CRM
🧠 MindManager – Organisez vos idées et vos projets efficacement.
Un outil puissant pour créer des mind maps, structurer vos stratégies et mieux collaborer.
→ Découvrir MindManager
🇬🇧 Gymglish – Améliorez votre anglais professionnel chaque jour.
Des cours personnalisés et courts pour progresser facilement, quel que soit votre niveau.
→ Profiter de l'essai gratuit
🌍 Preply – Apprenez une langue avec un professeur particulier.
Trouvez un enseignant adapté à vos objectifs et progressez à votre rythme.
→ Trouver votre professeur
The KREMLIN malware infiltrates systems via a deceptive JavaScript file, often disguised as a bank receipt or invoice. When this file is opened, it triggers a complex infection chain that results in the installation of a rogue extension. This extension is installed directly into Chrome and Edge profiles without going through the Chrome Web Store, thus escaping the usual integrity checks.
To avoid triggering alerts, KREMLIN regenerates the cryptographic hashes used by Chromium to verify extensions. By exploiting these vulnerabilities, it manages to remain undetectable to users and security systems. Once active, the extension connects to a command server, receiving instructions every second to steal essential information.
KREMLIN’s Tactics for Stealing Data
Once installed, KREMLIN’s rogue extension establishes a connection with a command server via a WebSocket channel. It can then perform various actions such as capturing screens, enumerating open tabs, stealing cookies, or injecting HTML code into visited pages.
The decoys used by KREMLIN mimic known Brazilian banking interfaces, and the error messages are written in Portuguese, indicating a particular focus on targeting Brazil. Indeed, the majority of infected systems are located in this country, with coordinated attacks during São Paulo’s business hours.
Elastic Security Labs and the Fight Against KREMLIN
Elastic Security Labs, which has tracked KREMLIN’s evolution over fifteen months, has implemented measures to curb the campaign. By registering a domain that KREMLIN queries before continuing its execution, they were able to disrupt the malware. This domain, by returning a valid response, simulates an analysis environment, prompting KREMLIN to halt its execution.
Elastic researchers recommend that users regularly check their extensions and disable developer mode on Chrome to spot these threats. Vigilance remains essential to prevent such attacks from compromising user security.
The Implications of KREMLIN for Online Banking Security
The theft of cookies and session tokens by malware like KREMLIN represents a major challenge for online banking security. This type of attack allows cybercriminals to access accounts without requiring new authentication, even after the victim has closed their browser.
Financial institutions must strengthen their security protocols to counter such threats, notably by improving authentication methods and closely monitoring the browser extensions used by their clients.
FAQ
How does KREMLIN manage to install an extension without being detected?
KREMLIN uses a sophisticated technique to regenerate the cryptographic hashes that Chromium uses to verify extensions, thus bypassing the usual security checks.
Which browsers are targeted by KREMLIN?
KREMLIN primarily targets Chrome and Edge browsers by installing an extension directly into their profiles.
Which countries are most affected by KREMLIN?
Brazil is the country most affected by KREMLIN, with over 1,500 systems infected, according to Elastic Security Labs.
What can users do to protect themselves from KREMLIN?
Users should regularly check their browser extensions, disable developer mode on Chrome when not necessary, and remain vigilant about the files they open.