The extension you never installed: KREMLIN forges Chrome’s own integrity checks to steal banking sessions

MITRE Techniques

• [T1059.007 ] JavaScript – The initial lure is a JavaScript file that the user manually executes to start the infection chain (‘the user manually executes’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The loader checks for sandboxes and aborts if the host looks artificial (‘If there are fewer than five files or fewer than 50 processes, the malware assumes it is running in a sandbox and aborts execution’).
• [T1105 ] Ingress Tool Transfer – The malware downloads additional stages, Node.js, binaries, and payloads from attacker infrastructure (‘downloads and installs malicious binaries from several sources’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence is established with a scheduled task that launches the malware at logon (‘registered as MicrosoftNodeRuntimeUpdater’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder? – The browser extension is installed directly into Chromium profile directories and activated through Secure Preferences changes (‘manually copies the extension into the browser’s profile directories and registers it in the Secure Preferences file’).
• [T1620 ] Reflective Code Loading – RunPE and manual mapping are used to execute payloads in memory (‘loads it as a .NET assembly’ and ‘manual mapping and calling its entrypoint’).
• [T1027 ] Obfuscated Files or Information – The loader and some strings are obfuscated/encrypted (‘strings are retrieved from a lookup table’ and ‘encrypts only some of its strings’).
• [T1014 ] Rootkit? – Not applicable; omitted because not clearly supported in the article.
• [T1057 ] Process Discovery – The malware enumerates running processes to detect analysis tools and sandbox software (‘searches it for process names associated with sandboxing software and security analysis tools’).
• [T1497.002 ] User Activity Based Checks – It waits for browser inactivity before modifying profile files (‘waits until the browser is closed or the user has been inactive for at least two minutes’).
• [T1005 ] Data from Local System – The extension collects browser databases, cookies, history, storage, and page source (‘Login Data’, ‘Cookies’, ‘Web Data’, ‘history’, ‘page source’).
• [T1056.001 ] Keylogging – The extension registers input listeners to capture text entered into fields (‘Whenever the user modifies one of these fields… the extension sends the captured data to the server’).
• [T1074.001 ] Local Data Staging: Local Data Staging – Collected data is compressed into ZIP archives before exfiltration (‘adds the following files and directories to a ZIP archive’).
• [T1041 ] Exfiltration Over C2 Channel – Stolen data is sent to C2 endpoints over HTTPS/WebSocket (‘The encrypted ZIP archive… are sent to the following two C2 endpoints’).
• [T1113 ] Screen Capture – The extension captures screenshots and uploads them (‘Captures the selected or active tab then uploads the compressed image’).
• [T1204.002 ] User Execution: Malicious File – The victim is tricked into opening a lure document or script (‘masquerading as a banking, invoice, or company document, which the user manually executes’).
• [T1114.001 ] Email Collection? – Not supported in the article; omitted.
• [T1106 ] Native API – The malware uses Windows APIs such as ZwQuerySystemInformation, ReadProcessMemory, and CryptUnprotectData (‘uses ZwQuerySystemInformation’ and ‘passes the remaining blob to CryptUnprotectData’).