September 17, 2026
- KREMLIN force-installs Chrome and Edge extensions without user approval — it waits for or kills the browser, copies the extension into the profile directories, enables developer mode, then retrieves the browser's own encryption keys to regenerate the Secure Preferences HMACs so the add-on passes Chromium's integrity checks. The chain starts from a JS file masquerading as an invoice, pulls Node.js, persists via scheduled task, and resolves its payload location from an Ethereum smart contract. Elastic tracks the Brazilian operation as REF9334 across at least seven campaigns since May 2025 impersonating 12 banks, with 1,515 confirmed infections almost all in Brazil. BleepingComputer, The Hacker News. · Threat Activity
in One Extension Hijacks the AI Assistant in Five Major Browsers