Affected Systems

Google Chrome and Microsoft Edge browsers on Windows systems. Active campaign since May 2025 with 1,515+ confirmed infections, primarily in Brazil. Affects users who execute malicious JavaScript files disguised as business documents.

Exploitation Status

Active exploitation confirmed since mid-2025. At least seven campaigns identified between May 2025 and September 2026. Elastic Security Labs has disrupted current campaign by registering anti-sandbox canary domain. Threat actor uses documented but rarely observed technique to bypass Chromium integrity checks.

Business Impact

Malware installs browser extensions without user approval by manipulating Chromium Secure Preferences and regenerating cryptographic integrity checks. Extensions steal credentials, session tokens, cookies, local storage, keylog form input, capture screenshots, intercept HTTP traffic, and inject malicious HTML. Attackers gain persistent access to banking sessions and sensitive corporate data. Infection vector is JavaScript files disguised as invoices, receipts, or business documents. Malware also deploys REMCOS RAT for additional remote access capabilities.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block execution of JavaScript (.js) files from email attachments and untrusted sources via Group Policy or endpoint protection policies
  • Monitor Chrome and Edge browser profile directories for unauthorized extension installations, specifically checking Secure Preferences file modifications and unexpected extensions in developer mode
  • Hunt for scheduled tasks establishing persistence for Node.js executables and review outbound connections to Ethereum smart contracts or Internet Archive domains
  • Deploy Elastic-provided IOCs to detect KREMLIN loader artifacts, REMCOS RAT, and associated infrastructure including Ethereum wallet 0x-prefixed addresses
  • Enforce browser extension allowlisting via Chrome Enterprise Policy (ExtensionInstallBlocklist/ExtensionInstallAllowlist) and Edge administrative templates to prevent unauthorized extension loading