BANKING MALWARE FORCES MALICIOUS EXTENSIONS

A banking malware operation has been deploying a toolkit called KREMLIN since mid-2025 to bypass browser security checks and force-install malicious extensions on Chrome and Edge browsers. The extensions target user credentials and session tokens.