> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens - URL: https://f4n6.co.uk/security-feed/kremlin-banking-malware-hijacks-chrome-and-edge-to-steal-credentials-and-session-tokens/ - Published: 2026-09-16T09:27:24.000Z - Updated: 2026-09-16T09:27:24.000Z - Author: Jeff Davies - Tags: #security-feed, REF9334 ## 1\. Executive summary Elastic Security Labs has documented KREMLIN, a previously undocumented Brazilian banking malware toolkit delivered by an actor it tracks as REF9334 and active since at least May 2025, using lures that impersonate roughly a dozen Brazilian banks to install a malicious extension on Google Chrome and Microsoft Edge. The toolkit chains a manually executed JavaScript loader, a C++ installer that sideloads an unsigned payload through a legitimate SentinelOne binary (`SentinelMemoryScanner.exe`), and a Chromium extension named "AVSync System Inc." that forges the browser's Secure Preferences HMAC metadata to survive integrity checks. Its objective is theft of credentials, session tokens and other browser-resident data, with C2 and payload hosting resolved dynamically from Ethereum smart contracts so the infrastructure cannot be taken down by conventional means. **No CVE, CVSS score, EPSS value or CISA KEV entry applies to this item** — the campaign abuses documented Chromium integrity-bypass techniques and DLL sideloading rather than a tracked software vulnerability. The direct targeting is Brazilian retail banking, but the session-token theft and Chromium integrity bypass are platform-level techniques that transfer to any EMEA financial services estate running Chrome or Edge with browser-based authentication — which is effectively all of them. Attribution to REF9334 is **unconfirmed**: the actor has no MITRE ATT&CK profile in our reference data, and the report is single-sourced. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. This is threat intelligence on an external campaign, not an incident at a client, and the item contains no fact that independently triggers a regulatory obligation. Conditional note: if a client confirms KREMLIN execution or extension installation on an in-scope system, the ordinary incident-handling chain becomes engaged — DORA Art. 17 (ICT-related incident management process), DORA Art. 18 (classification of ICT-related incidents and cyber threats) and DORA Art. 19 (reporting of major ICT-related incidents to competent authorities), or NIS2 Art. 23 (incident reporting obligations) / UK NIS 2018 OES-RDSP duties for entities in those regimes. That determination depends on facts not present here (affected entity, materiality, duration, client impact) and must not be pre-judged from this advisory. ## 3\. Technical analysis & attack chain ### Confirmed attack chain 1. **Initial execution (user-initiated).** The victim manually executes a JavaScript file that masquerades as a banking document, an invoice, or a company document. There is no exploit and no drive-by component in the reported chain — execution depends on the user running the file. 2. **Stage 1 — multi-stage JavaScript loader.** The loader performs sandbox and virtual-machine checks and only proceeds if it is not running inside a sandbox or VM. It then downloads and installs additional payloads before launching the next stage. 3. **Stage 2 — persistence, resolver lookup, staging.** The second stage performs four functions: establishes persistence via a **scheduled task**; retrieves download locations from an **Ethereum smart contract** acting as a dead-drop resolver; downloads the required binaries from those locations; and executes the third stage. 4. **Stage 3 — payload set.** The URLs retrieved from the smart contract host three components: a malicious browser-extension installer payload, a **.NET PE injector**, and **`SentinelMemoryScanner.exe`** — a legitimate binary associated with SentinelOne, used for DLL sideloading. 5. **DLL sideloading.** The custom C++ installer abuses the signed SentinelOne binary to sideload its unsigned main payload, which impersonates **`SentinelAgentCore.dll`**. 6. **Second evasion gate.** The sideloaded DLL repeats sandbox/VM checks: it enumerates running processes against a hard-coded list and inspects hardware properties (CPU count and RAM). If any running process matches the list, or if the system does not have 2 CPUs or does not exceed 3 GB RAM, the malware terminates execution. 7. **Resolver query and extension retrieval.** KREMLIN queries the same Ethereum smart contract to fetch two domains — `volmira[.]site` and `zaviro[.]online` — and queries the former to obtain the browser extension version (**"1.0.0"**) and extension ID (**`ndpbidppejfanjbhfgjlohfanbfbklff`**). The extension is named **"AVSync System Inc."** 8. **Version-aware install.** Before downloading, the malware checks whether the extension is already installed and, if so, compares the installed version against the version reported by the server. It downloads the extension only when no local installation is found or the versions differ. The Chrome extension is delivered as a **ZIP archive**. 9. **Integrity bypass and installation.** To install on Chromium-based browsers, the toolkit uses publicly documented integrity-bypass techniques referred to as **Phantom Extension** and **GhostChrome-X**, without tripping the Secure Preferences protection mechanism. The method modifies the **Secure Preferences** file, enables Chrome's **developer mode**, and updates the **`protection.macs`** JSON object with forged metadata so the malicious extension is registered as trusted. 10. **Collection and exfiltration.** Once installed, the extension harvests and exfiltrates browser data on a per-profile basis. ### Technical specifics that matter to a defender - **No vulnerability is exploited.** The chain relies on user execution of a `.js` file, a signed third-party binary already present or dropped for sideloading, and a documented Chromium metadata-forgery technique. Patch management alone does not break this chain; application control, browser policy and extension governance do. - **The integrity bypass defeats a control defenders assume is intact.** Secure Preferences HMAC regeneration and App-Bound encrypted hash manipulation mean a tampered extension can appear consistent to the browser's own validation. Detection must therefore come from file-integrity monitoring on the Secure Preferences file and from extension inventory, not from the browser's internal trust state. - **Infrastructure is resilient by design.** Because C2 endpoints and payload hosting locations are resolved from an Ethereum smart contract, domain and IP blocklisting is a point-in-time control only — the actor can rotate endpoints without touching the malware. Blocklisting the two known domains is still worthwhile, but it is not durable containment. - **Living-off-trusted-binaries.** Abuse of `SentinelMemoryScanner.exe` to sideload `SentinelAgentCore.dll` means the malicious DLL is unsigned while the loading process is a legitimate, signed security-vendor binary. Endpoint tooling that trusts signed SentinelOne processes by name will not flag this on signature alone. ### Caveats and unconfirmed claims - **Single-sourced.** All technical detail above derives from one vendor research effort (Elastic Security Labs), reported via The Hacker News. We have not independently corroborated the loader chain, the smart-contract resolver, or the extension artefacts. Treat the IOC set in §5 as single-sourced; verify before enforcement. - **Attribution is unconfirmed.** "REF9334" is a vendor tracking moniker. The actor has **no MITRE ATT&CK profile** in our reference data, and no nation-state or criminal-group attribution is established. Do not treat REF9334 as a resolved identity. - **Technique overlap is not attribution.** The report notes that APT31 used the same integrity-bypass approach in a late-August 2026 campaign leveraging the BlueMoon exploit kit (now-patched Chrome and Windows zero-days) to install an extension codenamed GemStone. This is a **shared-technique observation only**. It does not link REF9334 to APT31, and the two campaigns differ fundamentally — APT31 used zero-day exploitation, KREMLIN uses user-executed JavaScript. - **Incomplete exfiltration detail.** The source material is truncated mid-sentence at the point of describing per-profile browser data harvesting. We cannot state the exfiltration protocol, destination, or data scope beyond "credentials, session tokens, and sensitive data." ## 4\. Mitigation & containment ### P1 — within 24 hours 1. **Block the known resolver domains** at DNS, secure web gateway and proxy layers: `volmira[.]site`, `zaviro[.]online`. Log and alert on any pre-block resolution — a hit is a strong indicator of prior compromise. 2. **Hunt for the extension by ID and name.** Enumerate installed extensions across Chrome and Edge for ID `ndpbidppejfanjbhfgjlohfanbfbklff` and name "AVSync System Inc." Force-remove any match and treat the host as compromised (session tokens must be revoked, not just the extension deleted). 3. **Hunt for the sideloading pair.** Search EDR telemetry for `SentinelMemoryScanner.exe` executing with a `SentinelAgentCore.dll` loaded from a path outside the legitimate SentinelOne installation directory. Any such pairing is a high-confidence detection. 4. **Check Secure Preferences integrity.** Compare the per-profile `Secure Preferences` file (under each browser's User Data profile directory) against a known-good baseline or backup. Look for developer mode enabled and for `protection.macs` entries that do not correspond to legitimately installed extensions. 5. **Enumerate scheduled tasks** created since May 2025 that launch script interpreters or binaries from user-writable paths (`%TEMP%`, `%APPDATA%`, `Downloads`). The chain establishes persistence via scheduled task; the task name is not given in the source, so triage by action and path rather than by name. ### P2 — within 72 hours 1. **Enforce extension allowlisting by policy.** Deploy `ExtensionInstallAllowlist` / `ExtensionInstallBlocklist` (or the Edge equivalents) via GPO/MDM so that only approved extension IDs can load. This is the single most durable control against this class of install. 2. **Disable developer mode by policy** on managed Chrome and Edge instances, and alert on any change to that setting. 3. **Block execution of `.js` files from user download and temp directories** via application control / AppLocker / WDAC, and via EDR execution policy. The initial access vector is a user manually running a JavaScript file. 4. **Restrict DLL search order abuse.** Where SentinelOne is deployed, confirm the agent directory is not user-writable and that sideloading from user-writable paths is blocked by EDR. 5. **Shorten browser session token lifetimes** and require re-authentication for high-value banking and treasury applications. This limits the value of any token already stolen. ### P3 — within 7 days 1. **User awareness push** targeted at finance and treasury staff: documents that arrive as `.js` files and ask to be run manually are not documents. Reinforce the existing "never execute a file to view it" rule. 2. **Add the §6 YARA and Sigma rules** to endpoint and SIEM detection pipelines, tuning for the false-positive notes given. 3. **Review browser extension inventory** across the estate for any extension not on the approved list, regardless of vendor, and remediate. 4. **Note that no vendor patch exists for this item** — there is no CVE to remediate. Any mitigation plan that consists only of "patch" will not address KREMLIN. ## 5\. Indicators of compromise All indicators below are **single-sourced** (Elastic Security Labs, via The Hacker News). Verify before enforcement. | type | value | confidence | source | | ------------- | ---------------------------------------------- | ------------------------------------------------------------------------- | ----------------------------------------- | | domain | volmira\[.\]site | medium — single source | Elastic Security Labs via The Hacker News | | domain | zaviro\[.\]online | medium — single source | Elastic Security Labs via The Hacker News | | extension\_id | ndpbidppejfanjbhfgjlohfanbfbklff | high — unique artefact | Elastic Security Labs via The Hacker News | | string | AVSync System Inc. | high — unique artefact | Elastic Security Labs via The Hacker News | | string | 1.0.0 (extension version reported by resolver) | low — generic value, context-dependent | Elastic Security Labs via The Hacker News | | filename | SentinelMemoryScanner.exe | medium — legitimate SentinelOne binary abused for sideloading | Elastic Security Labs via The Hacker News | | filename | SentinelAgentCore.dll | medium — legitimate SentinelOne DLL name impersonated by unsigned payload | Elastic Security Labs via The Hacker News | No file hashes, IP addresses, URLs, registry keys or email indicators are present in the source material. The Ethereum smart contract address used as the dead-drop resolver is **not disclosed** in the source and is therefore not listed. ```iocs domain volmira[.]site domain zaviro[.]online extension_id ndpbidppejfanjbhfgjlohfanbfbklff string AVSync System Inc. filename SentinelMemoryScanner.exe filename SentinelAgentCore.dll ``` ### Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | ------------------------------------------------------- | | Manual execution of a .js file posing as a banking, invoice or company document | EDR process creation; wscript.exe / cscript.exe / browser-initiated file execution | medium — single source | | Sandbox/VM evasion: process enumeration against a hard-coded list, plus CPU-count and RAM checks; termination if <2 CPUs or ≤3 GB RAM | EDR process telemetry; malware self-termination events | medium — single source | | Scheduled task creation for persistence | Windows Task Scheduler operational log; EDR scheduled-task telemetry | medium — single source | | DNS/TLS resolution to volmira\[.\]site or zaviro\[.\]online | DNS logs, secure web gateway, proxy | medium — single source | | Modification of the Chromium Secure Preferences file with forged protection.macs metadata and developer mode enabled | File integrity monitoring on browser profile directories | medium — single source | | SentinelMemoryScanner.exe loading SentinelAgentCore.dll from a non-standard path | EDR module-load telemetry | medium — single source | | Outbound resolution to Ethereum smart contract infrastructure for C2/payload location lookup | Proxy/TLS telemetry to blockchain RPC endpoints from non-developer hosts | low — technique described, no atomic indicator provided | ## 6\. Detection ```yara rule KREMLIN_Banking_Malware_Artifacts { meta: author = "Adverse Trace" date = "2026-09-16" reference = "https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html" description = "Detects KREMLIN toolkit artefacts: malicious Chromium extension 'AVSync System Inc.' (ID ndpbidppejfanjbhfgjlohfanbfbklff), dead-drop resolver domains, and SentinelOne DLL-sideloading payload names. Single-sourced; tune before production deployment." tlp = "AMBER" false_positive_note = "SentinelMemoryScanner.exe and SentinelAgentCore.dll are legitimate SentinelOne filenames. Require co-occurrence with the unique extension artefacts before alerting." strings: $ext_id = "ndpbidppejfanjbhfgjlohfanbfbklff" ascii wide nocase $ext_name = "AVSync System Inc." ascii wide $dom_1 = "volmira.site" ascii wide nocase $dom_2 = "zaviro.online" ascii wide nocase $sideload = "SentinelAgentCore.dll" ascii wide nocase $loader = "SentinelMemoryScanner.exe" ascii wide nocase condition: 2 of them } ``` ```yaml title: Chromium Secure Preferences Tampering - KREMLIN Extension Install id: 8f2c1a44-7b90-4d3e-9a11-6c0e5b2d7f31 status: experimental description: Detects modification of the Chromium Secure Preferences file by a process other than the browser itself, consistent with the KREMLIN Phantom Extension / GhostChrome-X integrity bypass that forges protection.macs metadata to register the 'AVSync System Inc.' extension. references: - https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html author: Adverse Trace date: 2026/09/16 tags: - attack.persistence - attack.defense_evasion - attack.t1176 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - '\Secure Preferences' filter_browser: Image|endswith: - '\chrome.exe' - '\msedge.exe' condition: selection and not filter_browser falsepositives: - Browser updates, profile migrations, and legitimate extension installs performed by the browser process itself - Third-party profile management or backup tooling level: high ``` ```yaml title: SentinelOne Binary Sideloading - SentinelMemoryScanner.exe id: 3d7a9e12-5c48-4f6b-b0a2-1e9d4c8a6b57 status: experimental description: Detects execution of the legitimate SentinelOne binary SentinelMemoryScanner.exe, which KREMLIN abuses to sideload an unsigned payload impersonating SentinelAgentCore.dll. Correlate with module-load telemetry showing SentinelAgentCore.dll loaded from a non-standard path. references: - https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html author: Adverse Trace date: 2026/09/16 tags: - attack.defense_evasion - attack.t1574.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: '\SentinelMemoryScanner.exe' condition: selection falsepositives: - Legitimate SentinelOne agent operations. Baseline the normal parent process and installation path for this binary in your estate before enabling at high severity. level: medium ``` ## 7\. Sources - The Hacker News — "KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens" — https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html — published 2026-09-15. - Elastic Security Labs — technical report by Cyril François and Andrew Pease, referenced by the above article. **No URL was provided in the source material**; the primary research has not been retrieved and reviewed by Adverse Trace. ## 8\. Adverse Trace position We assess this as a **moderate, technique-driven risk to EMEA financial services clients, with no applicable CVSS score, no CISA KEV entry and no vendor patch** — the campaign exploits user execution and a documented Chromium integrity bypass rather than a tracked vulnerability, so it will not appear in any patch-driven prioritisation workflow. The direct targeting is Brazilian retail banking, but the two capabilities that matter — forging Secure Preferences HMAC metadata to install a persistent extension, and harvesting browser session tokens — are platform-level and transfer directly to any estate using Chrome or Edge for authenticated banking, treasury or SaaS access. The entire technical picture rests on a **single vendor report**, and the REF9334 attribution is **unconfirmed with no MITRE ATT&CK profile**; we are not treating the actor identity as established, and we are not linking this campaign to APT31 on the basis of a shared technique. We will retrieve and review the underlying Elastic Security Labs report to corroborate the loader chain, the smart-contract resolver mechanism and the extension artefacts, and will reissue this advisory if the IOC set changes or if the exfiltration detail truncated in the source becomes available. Clients should action the P1 hunts in §4 immediately — extension inventory and Secure Preferences integrity checking are the two controls that actually detect this, and neither is covered by conventional patching. --- [Read the original source →](https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*