Author: DigitalSpying Security Desk
Date: September 15, 2026
Executive Summary
A sophisticated cybercrime operation targeting corporate banking and retail financial institutions has been exposed by Elastic Security Labs and reported by The Hacker News. Tracked under the threat designation REF9334, the threat actors deploy a multi-stage malware ecosystem known as KREMLIN, which specializes in hijacking Google Chrome and Microsoft Edge browser sessions across Brazilian and international financial portals. The operation is notable for its subversion of modern Chromium browser integrity protections: using advanced techniques known as "Phantom Extension" and "GhostChrome-X," KREMLIN directly tampers with Chromium's Secure Preferences configuration, regenerates HMAC verification signatures, and circumvents Google's newly introduced App-Bound encryption safeguards to install malicious extensions without user consent. Furthermore, the operators leverage Ethereum blockchain smart contracts as immutable dead-drop resolvers, preventing infrastructure disruption and domain sinkholing.
Deep-Dive Technical Analysis
1. Delivery & SentinelOne Binary Sideloading
The infection chain begins with targeted financial lures (fake corporate invoices, banking verification requests, or fiscal documents) delivered via spear-phishing:
* JavaScript Multi-Stage Loader: The initial JavaScript loader conducts hardware and sandbox validation. It interrogates system properties, terminating execution if the host has fewer than 2 CPU cores, less than 3 GB of RAM, or if sandbox analysis processes are present.
* Sideloading via Signed Security Binaries: To achieve memory execution without alerting endpoint security, KREMLIN drops a legitimate, digitally signed SentinelOne executable (SentinelMemoryScanner.exe).
* SentinelAgentCore.dll Hijacking: The legitimate binary is manipulated to sideload an unsigned, malicious DLL (SentinelAgentCore.dll). This living-off-the-land technique allows the malware to inherit the trust of signed security binaries, defeating static signature detection engines.
2. Subverting Chromium Secure Preferences & App-Bound Encryption
Google Chrome and Microsoft Edge enforce rigorous integrity mechanisms to protect browser settings, installed extensions, and sensitive credentials:
* The Chromium Protection Architecture: Modern Chromium stores extension configurations in JSON format within %LOCALAPPDATA%\Google\Chrome\User Data\Default\Secure Preferences. To prevent third-party malware from silently injecting extensions, Chromium calculates HMAC-SHA256 signatures across critical JSON sub-objects (stored in protection.macs), keyed to device-specific hardware properties and user registry seeds.
* The "Phantom Extension" / "GhostChrome-X" Bypass:
1. KREMLIN parses the local Secure Preferences file while the browser process is inactive or suspended.
2. It forcibly toggles Chromium Developer Mode flags to true.
3. It extracts the local device identity seed, regenerates valid HMAC signatures for the protection.macs object, and inserts a forged extension entry named "AVSync System Inc." (Extension ID: ndpbidppejfanjbhfgjlohfanbfbklff).
4. It circumvents Windows App-Bound encryption by intercepting decrypted session master keys in user memory prior to persistent encryption.
* Silent Installation: When Chrome or Edge restarts, the browser validates the forged HMAC hashes, assumes the extension was authorized via developer configuration, and loads the malicious payload with zero user security prompts or confirmation dialogs.
Stage
Action Description
Technical Outcome
I. Execution
Victim executes malicious JavaScript lure
Hardware validation & anti-sandbox check passed
II. Persistence
Drops SentinelMemoryScanner.exe
Sideloads malicious SentinelAgentCore.dll
III. Resolution
Queries Ethereum Smart Contract
Resolves C2: volmira[.]site & zaviro[.]online
IV. Subversion
Modifies Secure Preferences JSON
Forges HMAC signatures; Bypasses App-Bound Encryption
V. Injection
Injects "AVSync System Inc." Extension
Stealth installation in Chrome / Edge browser
VI. Exfiltration
Real-time WebSocket & CSS-masqueraded data
Full DOM, Cookies, and Screenshots exfiltrated
3. Decentralized C2: Ethereum Blockchain Dead-Drop Resolvers
To guarantee infrastructure resilience against domain takeovers, law enforcement seizures, and DNS sinkholing, KREMLIN integrates Web3 decentralized infrastructure:
* Smart Contract Resolution: Rather than hardcoding fixed command-and-control domains or falling back to traditional Domain Generation Algorithms (DGAs), KREMLIN queries verified smart contracts deployed on the Ethereum mainnet.
* Immutable Configuration Updates: The threat actors dynamically update the target payload domains (volmira[.]site, zaviro[.]online) by executing smart contract state transactions. Security analysts cannot sinkhole or alter contract variables without possessing the private deployment keys, giving the botnet high operational survivability.
4. Browser Session Hijacking & Masqueraded Data Exfiltration
Once active, the malicious extension registers high-privilege permissions across all active browser tabs (cookies, storage, webRequest):
* WebSocket Command Loop: Connects to luizestrelhashapr[.]online:443, supporting real-time commands:
* Capturing compressed JPEG screenshots of active banking tabs.
* Stealing sessionStorage, localStorage, and active session authentication cookies.
* Dumping full HTML DOM source code to capture transaction authorization numbers and one-time passwords (OTPs).
* Injecting dynamic phishing overlays when targeted banking URLs are loaded.
* Stealth Polling via Disguised CSS Paths: In addition to WebSockets, the extension periodically dispatches exfiltrated telemetry via HTTP GET/POST requests masquerading as stylesheet assets (e.g., 108766d0.css for cookie exfiltration, 0f51ad2f.css for compressed screenshots).
Industry Impact & Financial Threat Ecosystem
* The Collapse of Browser-Level Trust: By successfully reverse-engineering and forging Chromium's HMAC protection mechanisms, malware operators have proven that client-side browser configuration files can be tampered with silently.
* Targeted Geographic Focus with Global Extensibility: While over 98% of the 1,515 confirmed infected endpoints identified by Elastic were geolocated in Brazil, the underlying architecture—specifically App-Bound encryption bypasses and blockchain C2 resolution—represents a portable threat model ready for deployment against corporate banking globally.
Actionable Recommendations & Defense Playbook
1. Enterprise Browser Policy Enforcement
Organizations must prevent rogue local extensions by locking down browser management policies:
* Enforce Extension Allowlisting: Deploy Chrome Enterprise and Microsoft Edge Group Policy Objects (GPOs) setting ExtensionInstallBlocklist = * and specifying approved extensions exclusively via ExtensionInstallAllowlist.
* Disable Developer Mode & Unpacked Extensions: Enforce DeveloperToolsAvailability = 2 (disabled) and block the loading of unpacked extensions on enterprise managed devices.
2. File Integrity Monitoring (FIM) for Browser Configurations
* Monitor Secure Preferences Modifications: Configure Endpoint Detection and Response (EDR) rules to alert on any process modifying Secure Preferences or Preferences files outside of legitimate chrome.exe or msedge.exe process trees.
* Detect DLL Sideloading via Security Binaries: Alert on instances where third-party security executables (such as SentinelMemoryScanner.exe or third-party diagnostic utilities) are executed from non-standard directories like %APPDATA% or %TEMP%.
3. Network Inspection & Blockchain Dead-Drop Hunting
* Monitor Smart Contract RPC Calls: Block or monitor endpoint connections to public Ethereum JSON-RPC nodes (e.g., Infura, Alchemy, public node endpoints) originating from desktop workstations that have no business-justified blockchain development use.
* Block Known IoCs: Blacklist active C2 and delivery domains: volmira[.]site, zaviro[.]online, and luizestrelhashapr[.]online.
Sources and Reference Intelligence: Elastic Security Labs Research, The Hacker News, Chromium Security Documentation.