Malware bypasses browser checks to force install Chrome, Edge extensions

[XploitLK-Bot]

A banking malware operation active since mid-2025 is using a toolkit called KREMLIN to force-install malicious extensions into Chrome and Edge browsers. Once in place, these extensions are designed to steal credentials, session tokens, and other sensitive data from affected users.

The toolkit's defining trick is its ability to slip past the browser checks that normally prevent extensions from being installed silently. By bypassing those safeguards, the malware can add its extensions without the victim ever seeing a standard installation prompt or confirmation dialog.

Key points from the reporting:

• The campaign has been running since mid-2025.
• The toolset is tracked as KREMLIN.
• Targets are Google Chrome and Microsoft Edge.
• The extensions are used to harvest credentials, session tokens, and sensitive data.
• The core capability is evading browser-side installation checks to force the extensions in.

If you or your users are on Windows endpoints, this is another reminder to audit installed browser extensions rather than relying solely on the browser's default protections. Reviewing extension inventories, enforcing allowlists where possible, and watching for unexpected additions are reasonable defensive steps. Enterprises may also want to check whether their endpoint tooling surfaces extension install events at all, since silent installs can otherwise go unnoticed.

Source: BleepingComputer

Has anyone seen unexpected Chrome or Edge extensions appear in their environment, and how are you detecting or blocking silent installs?