An operation tracked by Elastic Security Labs as REF9334 is using the KREMLIN toolkit to install a malicious extension in Chrome and Edge. The report published on September 14, 2026 describes activity since May 2025, including lures impersonating documents from twelve Brazilian banks. BleepingComputer reported on the technique on September 16.
The important point is not only that the extension is installed quietly. Once present, the extension called AVSync can read data normally protected by the browser: cookies, session storage, page content, and text entered into forms. An already-open banking session can therefore become a target even when the victim is never asked to type the password again.
What happened
The chain starts with a JavaScript file that the user opens manually, believing it is a bank receipt, invoice, payment record, or company document. The first script displays a fake error, checks whether it is running in an analysis environment, then downloads Node.js and later stages. A scheduled task provides persistence, while an Ethereum smart contract supplies download or command locations.
Later stages install a loader and a C++ component. Elastic also describes the abuse of a legitimate SentinelOne binary to load an unsigned DLL. The report links the infrastructure to seven campaigns observed since 2025. This is therefore not an isolated file, but a maintained toolkit that has changed over time.
How KREMLIN forces its way into Chrome and Edge
KREMLIN does not need the user to approve an extension in the Chrome Web Store. The program waits for the browser to close or become idle, then copies the extension into Chromium profile directories. It enables developer mode and registers the extension in the Secure Preferences file.
That file contains cryptographic checks that normally detect changes to browser preferences. The malware retrieves the keys used by the browser and recreates the expected HMACs and encrypted hashes. Chrome or Edge can then treat AVSync as correctly installed even though nobody clicked “Add”. The technique is publicly documented, but Elastic describes it as rarely seen in malware.
What the extension can expose
Elastic says AVSync requests access to tabs, cookies, storage, and the webRequest API. Its scripts can steal cookies, localStorage, and sessionStorage, enumerate open tabs and some history data, capture the active tab, and retrieve a page’s full HTML.
The extension can also observe text entered into forms, intercept HTTP request bodies and headers, inject attacker-controlled HTML, and redirect selected clicks. It communicates with its infrastructure over WebSocket and through requests made to resemble stylesheet loads. The exact capability depends on the configuration and infected profile; the analysis does not prove that every listed data type was exfiltrated from every machine.
What the observed scope means
Elastic recorded 1,515 systems attempting to reach a network-canary domain during its analysis. 98.75% of those systems were geolocated to Brazil, supporting the report’s assessment of the operation’s primary focus. This result measures machines visible through that specific mechanism, not the total number of REF9334 victims.
Registering the domain disrupted the campaign by making the loader believe it was running in a sandbox. That stopped further execution for some observed infections, but it did not remove the component already present on the machines. Elastic’s published indicators should therefore support search and remediation, not be used to conclude that a device is clean because the extension is no longer visible.
What users and organizations should do
For users
If AVSync or another unexpected extension appears in Chrome or Edge, stop using that profile for banking, email, and work services. Record the displayed name and ID, disconnect the device from the network, and contact support. If the device belongs to an organization, avoid destroying evidence before getting guidance.
From a trusted device, revoke active sessions and change passwords that may have been entered in the browser. Prioritize email, banking, and administrator accounts. Review recovery settings and enable MFA where available: it does not invalidate stolen cookies by itself, but it reduces the risk during a new login.
For organizations
Search for unexpected extensions, enabled developer mode, abnormal Chrome and Edge profile changes, recently added scheduled tasks, and unplanned Node.js downloads. Compare findings with Elastic’s published indicators of compromise and preserve logs before cleanup.
Treat a suspicious device as potentially compromised: isolate it, collect evidence, perform validated cleanup or reinstallation, revoke sessions, and rotate secrets. Extension-install policies, managed browser profiles, and browser logging add useful controls; they do not replace analysis of a device that executed the fake document.
The Soclyde connection
Soclyde does not protect Chrome, Edge, the targeted banks, or the devices affected by REF9334. It cannot make a stolen cookie trustworthy again and does not replace EDR, forensic analysis, or session revocation.
Its role is in restoring order: generate a distinct secret for every account, keep it in an encrypted local-first vault, and quickly identify the access that must be rotated after a device is isolated. This separation reduces the chance that a password entered in a compromised browser is reused elsewhere. Read our secure password generator guide to structure that rotation.
Key points
KREMLIN shows how an extension can become the control point for a banking session without a visible browser installation. The risk comes from the full chain: fake JavaScript document, persistence, a Secure Preferences bypass, and access to cookies, page content, and typed text.
Elastic’s 1,515 observed systems indicate an active campaign, but they are not a total victim count. For users and teams, the priority is to isolate the device, revoke sessions, and rotate secrets from a trusted environment. For the next step, read our secure password generator guide or contact Soclyde.
