A New Browser Threat Named KREMLIN Is Targeting Chrome and Edge Users

Security researchers have identified a malware campaign called KREMLIN that hijacks Google Chrome and Microsoft Edge to steal login credentials and active session tokens. According to reports, the campaign has been tracked under the designation REF9334 by Elastic Security Labs and appears to have been active since at least May 2025, primarily targeting users of Brazilian banking services. While the current focus appears regional, the techniques involved (installing rogue browser extensions and bypassing built-in browser protections) are a reminder that any Chromium-based browser can be a target for this style of attack.

What makes KREMLIN notable isn't just that it steals passwords. It reportedly goes after session tokens and cookies too, which means attackers may not even need your password to access an already logged-in account.

How Credential and Session Token Theft Works

Most people think of credential theft as a hacker guessing or phishing a password. Session token theft is different, and arguably more dangerous, because it targets the data your browser uses to prove you're already authenticated. When you log into a banking site, email account, or work portal, your browser stores a session token or cookie that tells the site "this user is already verified, let them in without asking for a password again." If malware can steal that token, an attacker can potentially impersonate your active session without ever knowing your actual login details, and in some cases without triggering multi-factor authentication prompts.

Reports on the KREMLIN campaign describe it using malicious browser extensions to gain this kind of access, reportedly bypassing Chromium's built-in integrity checks that are supposed to prevent unauthorized extensions from being silently installed or from tampering with browser data. This is consistent with a broader pattern seen in other recent incidents. Similar tactics were used in a campaign covered here at vpn.social, where malicious Chrome extensions were caught stealing crypto data by embedding themselves quietly into the browser and harvesting sensitive account information. Extensions remain an attractive attack surface because they often request broad permissions and run with significant access to what happens inside your browser tabs.

Why Browsers Have Become a Favorite Target

Browsers are no longer just a window to the internet. They're where people log into banking apps, manage cryptocurrency wallets, handle work email, and store passwords in built-in managers. That makes them an efficient single point of compromise for attackers rather than having to target dozens of separate applications.

This shift is showing up across multiple malware families, not just KREMLIN. Ransomware operators have also started treating the browser itself as infrastructure. One example covered previously involved Chaos ransomware's msaRAT tool hiding command-and-control traffic inside a victim's own browser, disguising malicious network activity as normal browsing behavior to avoid detection. Whether the goal is ransomware deployment or straightforward credential theft, attackers increasingly see value in living inside the browser rather than around it.

Keeping browsers updated remains one of the most basic and effective defenses against this category of threat. Google, for instance, regularly ships security patches for actively exploited flaws, including a fix detailed in our coverage of Chrome 153 patching its seventh zero-day of the year. Vulnerabilities like these can sometimes be chained with malicious extensions or scripts to gain deeper access to a system, so staying current on updates closes off one avenue attackers rely on.

What This Means For You

If you use Chrome or Edge, and especially if you do online banking or manage cryptocurrency through your browser, it's worth taking a few precautions even if you're not in the specific region currently being targeted by KREMLIN. Malware campaigns like this tend to expand their scope over time once the underlying techniques prove effective.

A VPN will not stop a malicious browser extension from stealing a session token that's already sitting on your device, but it does add a layer of protection by encrypting your traffic and making it harder for attackers on shared or untrusted networks to intercept data in transit. Combined with good browser hygiene, that extra layer meaningfully reduces your overall exposure.

Actionable Takeaways

  • Review your installed Chrome and Edge extensions regularly and remove anything you don't actively use or don't recognize.
  • Only install extensions from official web stores, and check permissions requested before installing.
  • Keep your browser updated to the latest version to receive security patches as soon as they're released.
  • Use a reputable password manager rather than relying solely on browser-saved credentials.
  • Log out of sensitive accounts (especially banking) when finished, rather than leaving sessions open indefinitely.
  • Consider using a VPN as an additional layer of protection for your network traffic, particularly on public or shared connections.

The KREMLIN malware campaign is a clear signal that browser-based threats are evolving beyond simple phishing. Staying vigilant about what you install and keeping your software updated remains the most practical defense available to everyday users right now.