How to get rid of KREMLIN Banking Trojan

What kind of malware is KREMLIN Banking Trojan?

KREMLIN Banking Trojan is a multi-stage banking trojan that secretly adds a malicious browser extension to Google Chrome and Microsoft Edge. The extension spies on online banking sessions, records what the victim types, steals cookies and saved passwords, and can even change what the victim sees on banking websites.

According to research published by Elastic Security Labs, the operation behind KREMLIN has been active since at least mid-2025 and mainly targets people in Brazil. The name comes from the malware author's alias - the campaigns have no Russian connection. Lures impersonate Brazilian banks and payment services, and everything shown to victims is written in Portuguese.

KREMLIN Banking Trojan overview

The infection starts with a JavaScript file disguised as a bank receipt, payment confirmation, or bank statement. When opened, it displays a fake error message, so the victim assumes the document simply failed to load. Meanwhile, it checks that it is running on a real computer rather than a researcher's test environment, downloads Node.js, and moves on to the next stage.

KREMLIN keeps part of its configuration in smart contracts on the Ethereum blockchain. Instead of relying on a fixed server address, the malware reads a public blockchain entry to learn where to download its next components. The operators can update these addresses at any time, which makes the campaign harder to shut down. Some payloads are also hidden inside ordinary-looking JPEG images uploaded to the Internet Archive.

In its latest version, KREMLIN hides behind a legitimate, signed SentinelOne program (SentinelMemoryScanner.exe) and abuses it to load its own malicious file - a technique known as DLL side-loading. A scheduled task named MicrosoftNodeRuntimeUpdater relaunches the malware one minute after every login.

How the malicious extension gets into the browser

Browser extensions are normally installed by the user or come from an official store. KREMLIN skips both by copying the extension directly into every Chrome and Edge profile and editing the browser's protected settings file. To get past Chrome's built-in tamper checks, it pulls the browser's internal encryption keys from memory and uses them to make its changes look genuine.

The malware waits until the browser is closed or the user has been idle for two minutes before doing this, and force-closes the browser if necessary. The browser then loads the extension as if the user had approved it. The version analyzed by Elastic is named AVSync System Inc V19.14.9, while earlier builds used names like FrameSync Driver System and FrameSync Plugin Project.

The extension is still listed on the browser's extensions page, with a plain generic icon and with Developer mode switched on. Neither the name nor the "publisher" belongs to any real product, so an unfamiliar entry like this is a strong sign of infection.

What KREMLIN Banking Trojan steals

Once the extension is in place, KREMLIN gathers the saved logins, cookies, autofill data, and extension files from each browser profile. It also grabs the keys needed to decrypt saved passwords, packs everything into an encrypted archive, and uploads it to two attacker servers. In practice, every password stored in Chrome or Edge can end up in the attackers' hands.

The extension then stays in contact with its Command and Control (C2) server and waits for instructions. Operators can take screenshots of open tabs, list which websites are open, copy cookies and other data that websites keep in the browser, download the full content of a page, and attempt to collect recent browsing history.

Banking session hijacking

The most dangerous features are aimed at online banking. On websites chosen by the attackers, the extension works as a keylogger, capturing everything typed into text fields, including usernames and passwords. It can also intercept form submissions and web requests, such as payment or transfer details, and send copies to the attackers.

The extension can also inject attacker-made content into web pages, and it can send the victim to another site when they click a particular button or link. This lets criminals display fake forms or prompts on a genuine banking page, or quietly steer the victim to a phishing site.

An earlier QR-themed variant targeted WhatsApp Web and the website of the Brazilian bank Sicoob. On these sites, it showed an overlay in Portuguese claiming the session was about to expire and asking the victim to scan a QR code again. The code was supplied by the attackers and was most likely used to take over the victim's accounts.

Additional payloads and scale

Some KREMLIN campaigns installed a Remote Access Trojan (RAT) alongside the extension - first PULSAR, and later REMCOS RAT. These tools give attackers live control over the whole computer, going far beyond what the browser extension can do on its own.

Elastic researchers registered a domain that the malware uses to detect test environments, which temporarily stopped new infections from progressing past the first stage. More than 1,500 infected systems contacted that domain, 98.75% of them located in Brazil, and the number was growing quickly - a sign that the campaign had only just begun.

Conclusion

KREMLIN Banking Trojan turns the victim's own browser against them. It steals saved passwords and cookies, records what is typed on banking sites, intercepts transaction data, and can alter or redirect banking pages - all while the browser treats the extension as legitimate. Some campaigns also hand attackers full remote control of the computer. KREMLIN should be removed immediately. More examples of trojans are Maverick, Javali, and CHAVECLOAK.

How did KREMLIN Banking Trojan infiltrate my computer?

As documented by Elastic Security Labs, KREMLIN spreads through JavaScript files named to look like Brazilian banking paperwork - payment receipts, bank statements, PIX and TED transfer confirmations, and, in later waves, business permits and certificates. The filenames reference Banco do Brasil, Caixa, Bradesco, Sicoob, C6 Bank, Inter, BTG, Safra, PagBank, PicPay, Santander, and Mercado Pago.

Other campaigns used a fake Adobe Acrobat plugin offered on a lookalike website, as well as LNK shortcut files that launch PowerShell scripts. The attackers also place parts of their infrastructure on hijacked legitimate websites, adding their own subdomain next to the original content.

More broadly, threats of this kind reach victims through phishing emails, messages with malicious attachments or links, fake download pages, malvertising, and pirated software. Files like these are typically sent as attachments or links, and a single click on the wrong one is enough to start the infection.

How to avoid installation of malware?

Be careful with unexpected emails and messages, especially those carrying receipts, invoices, or bank documents. Real banks do not send documents as JavaScript (.js or .jse) files, so never open one. Download software and updates only from official websites and app stores, and avoid cracks and pirated programs.

Keep Windows and your applications up to date, and check your browser's extensions page from time to time, removing anything you do not recognize. Use reputable security software and run regular scans. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Malicious KREMLIN Banking Trojan extension (AVSync System Inc V19.14.9) installed in Chrome (source: elastic.co):

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is KREMLIN Banking Trojan?
• STEP 1. Manual removal of KREMLIN Banking Trojan malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with KREMLIN Banking Trojan malware, should I format my storage device to get rid of it?

Formatting would remove KREMLIN, but it also deletes every file on the drive. Try a reputable security tool such as Combo Cleaner first. After cleaning, change your banking and email passwords from a device you know is clean.

What are the biggest issues that KREMLIN Banking Trojan malware can cause?

KREMLIN can steal saved passwords and cookies, record logins typed on banking sites, intercept transaction details, and show fake content on genuine bank pages. This can lead to drained bank accounts, hijacked online accounts, and identity theft. Some campaigns also install a RAT that gives attackers full control of the computer.

What is the purpose of KREMLIN Banking Trojan malware?

The purpose of KREMLIN is to hijack online banking sessions. It does this through a hidden browser extension that steals credentials and cookies, logs keystrokes, and manipulates banking websites, mainly targeting customers of Brazilian banks and payment services.

How did KREMLIN Banking Trojan malware infiltrate my computer?

KREMLIN is spread through JavaScript files disguised as Brazilian bank receipts, statements, and transfer confirmations. Opening such a file starts the infection. Other campaigns used a fake Adobe Acrobat plugin and LNK shortcut files that run PowerShell scripts.

Will Combo Cleaner protect me from malware?

Yes. Combo Cleaner can detect and remove most known malware. KREMLIN places components in several locations (a scheduled task, program files, and browser profiles), so a full system scan is recommended to make sure nothing is left behind.