The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Reported 16 Sep 2026 by otx · Severity: medium

Brazilian banking malware operation REF9334 has been deploying KREMLIN toolkit since May 2025, targeting Brazilian financial institutions through malicious browser extensions. The operation uses multi-stage JavaScript loaders, custom C++ installers, and exploits Chromium integrit