# The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

KREMLIN malware forges Chrome/Edge Secure Preferences HMACs and App-Bound encrypted hashes to silently install a malicious extension that steals banking credentials and session tokens.

- Payout: Real-world hack
- Severity: high
- Program: Google
- Analysis by: Cyril François, Andrew Pease
- Disclosed: 2026-09-14
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-malicious-browser-extension-kremlin-banking-malware
- Tags: area:os domain:browser domain:desktop impact:ato impact:data-leak kind:incident platform:threat-intel sev:high tech:chromium tech:windows technique:reverse-engineering technique:source-review vuln:info-disclosure vuln:misconfiguration vuln:secrets-leak

**Target:** Chromium-based browser profile (Secure Preferences, OSCrypt keys, resources.pak seed)
**Root cause:** Chromium's Secure Preferences integrity relies on HMACs and App-Bound encrypted hashes derived from a seed in resources.pak and an OSCrypt key recoverable from the browser process; malware that can read these can regenerate valid integrity values for attacker-added extension entries.
**Steps:**
1. Deliver a JavaScript lure the user executes; loader checks sandbox (desktop file count <5, process count <50) and aborts if detected.
2. Extract CAB with scheduled task `conhost.exe --headless node.exe` registered as MicrosoftNodeRuntimeUpdater for persistence.
3. Query Ethereum contract `0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b` for main-v2/sub-module/sentinel URLs; download installer.
4. Sideload unsigned payload as SentinelAgentCore.dll via SentinelMemoryScanner.exe, releasing LdrpLoaderLock to start a thread from DllMain.
5. Wait for browser idle (GetLastInputInfo) or TerminateProcess it; relaunch under debugger with `--no-startup-window`.
6. Read legacy OSCrypt key from `%LOCALAPPDATA%\Google\Chrome\User Data\Local State` os_crypt.encrypted_key, strip 5-byte DPAPI prefix, CryptUnprotectData.
7. On LOAD_DLL_DEBUG_EVENT for chrome.dll/msedge.dll, scan .rdata for `OSCrypt.AppBoundProvider.Decrypt.ResultCode`, find RIP-relative LEA in .text, ReadProcessMemory the key buffer.
8. Extract seed from `%PROGRAMFILES%\Google\Chrome\Application\<VERSION>\resources.pak`.
9. Copy extension into profile dirs; edit Secure Preferences: set extensions.ui.developer_mode and account_values.extensions.ui.developer_mode true, add extensions.settings.<id>, recompute protection.macs legacy HMACs and *_encrypted_hash values plus super_mac/super_encrypted_hash.
10. Extension connects WebSocket `/google_ws/`, polls commands (GSH01 screenshot, GCO01 cookies/storage, GSO01 source, INC01 inject HTML, UPD01 config) and polls `/google_api/*.css` for targeting/keylog/redirect config.
11. Exfiltrate Login Data, Web Data, Network/Cookies, Extensions plus keys.json (v10/v20 keys) RC4-encrypted via SystemFunction032 to `/api/savecreds` and `/api/v1/fingerprint`.
**How found:** Elastic Security Labs tracked REF9334 across seven campaigns from May 2025, deobfuscated the JS loader with an LLM, reverse-engineered the C++ installer (string XOR `cipher[i]^((0x34+i)&0xFF)`, PigSyscall SSN resolution), and built an LLM-generated playground to exercise the extension's keylogging/interception config.
**Exploitation:** Banking lures trick users into running a JS loader; multi-stage chain installs a C++ installer that forges Chromium integrity to silently register a malicious extension in Chrome/Edge. The extension keylogs inputs, intercepts POST bodies/headers, redirects clicks, and exfiltrates cookies, sessionStorage, localStorage, history, screenshots and page source to C2 resolved via Ethereum dead-drop and workers.dev endpoints, enabling banking session theft.
**Escalation:** Chained Ethereum smart-contract C2 resolution for resilient infrastructure updates, sideloading a legitimate SentinelOne binary to evade AV, and combining credential/cookie theft with in-page HTML injection and redirects to hijack live banking sessions.
**Insight:** Chromium's Secure Preferences integrity is only as strong as the secrecy of the resources.pak seed and the App-Bound key in process memory; any code running as the user can debug the browser, recover both, and mint valid HMACs/encrypted hashes for arbitrary extension entries — so treat local profile integrity as bypassable and hunt for debug-launched browsers plus Secure Preferences writes.

## Proof of concept (copied exactly from the original report)

**Secure Preferences JSON with forged HMACs to activate extension**

```
{
 "extensions": {
 "ui": {
 "developer_mode": true
 },
 "settings": {
 "<extension-id>": {
 "...": "extension configuration"
 }
 }
 },
 "account_values": {
 "extensions": {
 "ui": {
 "developer_mode": true
 }
 }
 },
 "protection": {
 "macs": {
 "extensions": {
 "ui": {
 "developer_mode": "<legacy HMAC>",
 "developer_mode_encrypted_hash": "<new hash>"
 },
 "settings": {
 "<extension-id>": "<legacy HMAC>"
 },
 "settings_encrypted_hash": {
 "<extension-id>": "<encrypted hash>"
 }
 },
 "account_values": {
 "extensions": {
 "ui": {
 "developer_mode": "<legacy HMAC>",
 "developer_mode_encrypted_hash": "<new hash>"
 }
 }
 }
 },
 "super_mac": "<aggregate MAC>",
 "super_encrypted_hash": "<new aggregate hash>"
 }
}
```

**Extension version/ID JSON response from C2**

```
'{"version":"1.0.0","id":"ndpbidppejfanjbhfgjlohfanbfbklff"}'
```

**Exfiltration POST endpoints and keys.json**

```
// keys.json
{"v10":"<hex key>","v20":"<hex key>"}
 
The ZIP archive is then encrypted with RC4 through the undocumented SystemFunction032 API, using the SHA-256 digest of the plaintext archive as the encryption key. The encrypted ZIP archive, Customer ID, and SHA-256 digest used as the RC4 key are sent to the following two C2 endpoints: hxxps://volmira[.]site//api/savecreds and hxxps://zaviro[.]online//api/v1/fingerprint. The following POST request was captured on our server:
```