Malware bypasses browser checks to force install Chrome, Edge extensions

The KREMLIN banking malware operation exploits a gap in browser security by directly writing malicious extensions into browser profile directories, then re-enabling native security mechanisms so the extensions appear trusted and legitimate. This technique circumvents built-in browser integrity checks that most users and security tools rely on as a last line of defense. The use of decentralized infrastructure—Ethereum smart contracts and the Internet Archive—makes takedowns significantly harder, prolonging victim exposure. This matters because credential-stealing extensions operate silently inside trusted browser sessions, giving attackers access to banking credentials, session tokens, and sensitive form data without triggering traditional endpoint alerts.