KREMLIN Malware Hijacks Chrome via App-Bound Encryption Bypass

A sophisticated Brazilian banking malware operation tracked as REF9334 has deployed an advanced toolkit dubbed KREMLIN (authored under the handle Kr3mlin4rt1st) that completely subverts modern Chromium security architectures. Active since at least May 2025 across seven documented campaigns, the operation targets customers of twelve major Brazilian financial institutions. Rather than relying on standard credential scraping, KREMLIN successfully neutralizes Google's flagship App-Bound Encryption defense and HMAC integrity controls to inject stealth extensions into Google Chrome and Microsoft Edge without triggering security warnings.

The threat group combines commercial-grade evasion techniques—including Ethereum smart contract dead-drop resolvers, sandbox-aware kill-switch canaries, and signed security agent DLL side-loading—with deep in-memory inspection of browser execution threads to steal banking credentials, active session cookies, and live DOM telemetry.

Technical Analysis

The KREMLIN infection sequence transitions through a multi-tiered execution pipeline designed to neutralize endpoint detection and weaponize legitimate browser internals:

Multi-Stage Infection Pipeline

Adversaries initiate delivery via spear-phishing and social engineering lures distributing deceptive invoices and financial paperwork:

• Initial JavaScript Execution: The victim executes an obfuscated JavaScript loader that performs rigorous anti-sandbox validation. It calculates desktop file counts and runs WMI queries to verify real user environments (requiring at least 2 CPU cores and 3 GB of physical RAM).
• Network Canary Check: The loader attempts to query an unregistered external domain. If the query succeeds—indicating network traffic interception within an automated analysis sandbox—the loader deliberately terminates execution.
• Signed Binary Abuse (DLL Side-Loading): To execute its main 64-bit C++ installer without triggering endpoint telemetry, KREMLIN downloads a legitimate, digitally signed SentinelOne executable (SentinelMemoryScanner.exe). It then side-loads an unsigned malicious payload masquerading as SentinelAgentCore.dll, bypassing standard EDR process heuristics.

Chromium App-Bound Encryption & Phantom Extension Bypass

Chromium's App-Bound Encryption mechanism was introduced to prevent unauthorized processes from reading DPAPI-protected encryption keys stored in browser profiles. KREMLIN bypasses this protection through a sophisticated memory inspection routine:

• Idle State Synchronization: Using the Windows API GetLastInputInfo, the malware waits until the victim has been idle for at least two minutes before initiating browser operations, or forces a termination via TerminateProcess to prevent file-locking collisions on the Secure Preferences file.
• In-Memory Debug Inspection: KREMLIN executes Chrome or Edge in the background under an attached debugger using the --no-startup-window parameter. Upon intercepting the LOAD_DLL_DEBUG_EVENT for chrome.dll or msedge.dll, it scans the .rdata section for the string OSCrypt.AppBoundProvider.Decrypt.ResultCode.
• Dynamic Key Extraction: Tracing the RIP-relative LEA instruction referencing that string in the .text segment, KREMLIN locates the decrypted key-buffer pointer and invokes ReadProcessMemory to extract the decrypted v20 OSCrypt key directly from browser memory.
• Integrity MAC Forgery: The installer extracts resource seeds from resources.pak to compute legacy HMAC signatures and modern encrypted SHA-256 hashes (_encrypted_hash), enabling support for Chromium versions 144 and newer. It writes the forged hashes into Secure Preferences, forces developer_mode: true, and silently registers the malicious extension without user confirmation.

Blockchain Dead-Drop Resolvers & Real-Time C2

To ensure resilience against domain seizures and hosting takedowns, the operation employs blockchain-based infrastructure:

• Ethereum Smart Contract Dead Drops: KREMLIN queries an immutable Ethereum smart contract (0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b) to resolve active payload delivery nodes and C2 server destinations, including volmira.site and zaviro.online.
• Malicious Extension Deployment: The injected extension, masquerading under the benign identity AVSync System Inc. (Extension ID: ndpbidppejfanjbhfgjlohfanbfbklff), establishes bidirectional WebSocket communications alongside fallback polling masquerading as stylesheet requests (108766d0.css, 0f51ad2f.css) under /google_api/ to luizestrelhashapr.online:443.
• Data Exfiltration: The extension bundles complete profile databases (Login Data, Web Data, Cookies, Extensions) along with an extracted keys.json file containing both legacy v10 and memory-extracted v20 keys. The archive is encrypted using RC4 via the undocumented API SystemFunction032 and exfiltrated to adversary servers.

Attack Vector & Impact

The operation represents a significant evolution in financial cybercrime, demonstrating that client-side browser hardening can be systematically undermined:

• Regional Attribution & Financial Footprint: Code artifacts contain Portuguese variable naming conventions (testar_nova_versao) and embedded authorization headers referencing Brazilian popular culture (MichelleMignon171). Blockchain analysis of the operator's wallet reveals 82 USDT transactions totaling over $20,000 processed strictly during São Paulo business hours.
• Mass Infection Telemetry: Elastic Security Labs disrupted the campaign's defense mechanism by registering the threat actor's network canary domain. Telemetry collected from the sinkhole revealed over 1,515 actively infected systems, with more than 98% geolocated in Brazil.
• Session Hijacking & Bypassing MFA: By harvesting live browser memory, session cookies, and HTML structures in real time, threat actors can bypass multi-factor authentication (MFA) and execute fraudulent banking transactions directly within authenticated user sessions.

Detection & Mitigation

Security teams must audit endpoints for unauthorized Chromium profile modifications and memory manipulation techniques:

Host-Level Forensic Audit

• Audit Browser Extensions: Search user profiles across Google Chrome and Microsoft Edge for unauthorized directories matching extension identifier ndpbidppejfanjbhfgjlohfanbfbklff (AVSync System Inc.).
• Inspect Secure Preferences: Audit the Secure Preferences JSON file in all user data directories for unauthorized developer mode settings (extensions.ui.developer_mode: true) and newly created protection.macs entries.
• Monitor Debugger & Memory APIs: Configure EDR detection rules for suspicious non-developer processes invoking CreateProcess with --no-startup-window or calling ReadProcessMemory and debugging APIs against chrome.dll or msedge.dll.
• SentinelOne Sideloading Detection: Inspect hosts for rogue instances of SentinelMemoryScanner.exe running outside authorized security agent paths or loading unsigned dynamic libraries (SentinelAgentCore.dll).

Enterprise Hardening & Remediation

• Enforce Browser Policies: Implement enterprise Administrative Templates (GPO/Intune) to enforce DeveloperToolsAvailability = 2 (disabled) and configure ExtensionInstallAllowlist to prevent unapproved side-loaded extensions.
• Network Perimeter Blocking: Invalidate outbound connections to known C2 domains (luizestrelhashapr.online, volmira.site, zaviro.online, granderevolucao.store) and inspect HTTP traffic for anomalous recurring .css requests targeting /google_api/ paths.
• Session Invalidation: Force an enterprise-wide session invalidation across identity providers, web applications, and banking services for any endpoint showing indicators of KREMLIN infection.