Malware has worked out how to add a browser extension you never approved

Open Chrome, type chrome://extensions in the address bar and look at what comes up. Everything on that list is meant to be something you chose. A Brazilian malware crew spent fifteen months working out how to break that assumption.

Elastic Security Labs published its findings this week on a toolkit whose own author named it KREMLIN, a label with nothing Russian behind it: the code comments are in Portuguese, the lures impersonate twelve Brazilian banks, and the operators' cryptocurrency transactions cluster around Sao Paulo office hours. The technique at the centre of it is what deserves attention elsewhere. Chrome and Edge keep a file recording which extensions you approved, signed so it cannot be edited behind your back. This malware pulls the browser's own encryption keys out of memory, copies its extension into your profile folder, switches on developer mode and then regenerates those signatures itself. The browser starts, finds the paperwork in order, and loads something you never saw.

It calls itself AVSync and it reads like a wish list: cookies and session tokens, keystrokes typed into forms including passwords, screenshots, browsing history, open tabs, and the ability to inject its own content into pages you visit. The session tokens matter most, because a stolen one lets somebody into your account without ever needing the password or the code from your phone. Elastic counted 1,515 infected machines, 98 percent of them in Brazil, across seven campaigns since May 2025.

The way in is dull and entirely avoidable: a JavaScript file arriving as a bank receipt, an invoice, a company document, which somebody has to double-click. Nothing that genuinely is a receipt needs you to run a .js file, and Windows will tell you the real file type if you turn on file extensions in File Explorer's View menu. Tendvane's safety check goes through what has installed itself on your PC and what has been set to launch with Windows, which is where the rest of this kit sits.