Malware campaign force-installs malicious Chrome and Edge extensions to steal credentials

The KREMLIN banking malware is silently installing malicious browser extensions to steal passwords and login sessions. Elastic Security Labs reported that the Brazil-linked toolkit has been involved in seven campaigns since May 2025, with over 1,500 infections disrupted.