{"id":244127,"date":"2026-09-17T05:22:17","date_gmt":"2026-09-17T10:22:17","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/09\/malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions"},"modified":"2026-09-17T05:22:17","modified_gmt":"2026-09-17T10:22:17","slug":"malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/09\/malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions","title":{"rendered":"Malware bypasses browser checks to force install Chrome, Edge extensions"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/malware-bypasses-browser-checks-to-force-install-chrome-edge-extensions.jpg\"><\/a><\/p>\n<p>A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data.<\/p>\n<p>Researchers at Elastic Security Labs found that the malicious extensions bypass Chromium\u2019s integrity mechanisms and load in browsers as if they had been approved by the user.<\/p>\n<p>The infection chain starts after the target user opens a JavaScript file disguised as a bank receipt, invoice, payment record, or business document.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data. Researchers at Elastic Security Labs found that the malicious extensions bypass Chromium\u2019s integrity mechanisms and load in browsers as if they had been approved by the [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[43,34,45],"tags":[],"class_list":["post-244127","post","type-post","status-publish","format-standard","hentry","category-business","category-cybercrime-malcode","category-finance"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=244127"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244127\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=244127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=244127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=244127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}