CTI · corroborated · 2026-09-20

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Full story & timeline

MITRE ATT&CK

• T1176 Software Extensions Persistence
• T1557 Adversary-in-the-Middle Credential Access
• T1539 Steal Web Session Cookie Credential Access
• T1555 Credentials from Password Stores Credential Access

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: KREMLIN Banking Malware Browser Extension Installation
id: c9a5e3f6-0b4d-4c1a-d7f8-3e0a9b5c4d6e
status: experimental
description: Detects installation or loading of the KREMLIN banking malware malicious Chrome/Edge extension (REF9334) that hijacks banking sessions to steal credentials and session tokens.
references:
  - https://www.elastic.co/security-labs
  - https://thehackernews.com
author: Tia N. List
date: 2026-09-20
tags:
  - attack.persistence
  - attack.t1176
logsource:
  category: file_event
  product: windows
detection:
  selection_chrome_ext:
    TargetImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
    TargetFilename|contains:
      - '\Extensions\'
      - '\Local Extension Settings\'
  filter_known:
    TargetFilename|contains:
      - '\Extensions\grklenplhmfldmkgkijmnhhdhfcfnkjp\'
      - '\Extensions\jbkfoedolllekgbhcbcoahefnbanhhlh\'
  condition: selection_chrome_ext and not filter_known
falsepositives:
  - Legitimate browser extension installations
level: high

References

• https://www.elastic.co/security-labs
• https://thehackernews.com