A banking malware operation active since mid-2025 has been using a toolkit named KREMLIN to install malicious Chrome and Edge extensions that steal credentials, session tokens, and sensitive data. [...]
Malware bypasses browser checks to force install Chrome, Edge extensions
Summary + source link. No paywalls, no tracking.