A previously undocumented Brazilian banking malware toolkit called KREMLIN has been detailed by Elastic Security Labs, which tracks the operation as REF9334. Active since at least May 2025, the campaign uses lures impersonating a dozen Brazilian banks to install malicious extensions on Google Chrome and Microsoft Edge.
The toolkit relies on multi-stage JavaScript loaders, custom C++ installers, and browser extensions to steal credentials, session tokens, and sensitive data. It bypasses Chromium integrity protections by altering Secure Preferences and regenerating HMACs.
A notable feature is the use of Ethereum smart contracts as dead drop resolvers to dynamically update command-and-control endpoints, making disruption harder. The infection chain begins with a manually executed JavaScript file disguised as a banking or company document, which launches a loader that only runs outside sandboxes or virtual machines.
The second stage establishes persistence, fetches download locations from an Ethereum contract, and retrieves payloads including a browser extension installer, a .NET PE injector, and a legitimate SentinelOne binary used for DLL sideloading. The sideloaded DLL impersonates SentinelAgentCore.dll and performs further sandbox checks, terminating if it detects fewer than 2 CPUs or 3 GB RAM.
The malware queries the same Ethereum contract to obtain two domains, volmira[.]site and zaviro[.]online, and fetches an extension named "AVSync System Inc." from the former. It installs the extension using a publicly documented integrity bypass technique called Phantom Extension and GhostChrome-X, modifying Secure Preferences and enabling developer mode to register the extension without triggering Chrome's protection. The same approach was used by China-linked APT31 in a late August 2026 campaign.
Once installed, the extension exfiltrates browser data for each profile to a C2 server at luizestrelhashapr[.]online:443, after requesting broad access to tabs, cookies, storage, and the webRequest API. It supports commands to take screenshots, enumerate tabs, steal cookies and storage, collect history, extract HTML, download attacker-controlled HTML, and refresh configuration. It also polls a "/google_api/" endpoint via requests disguised as CSS file fetches, with each CSS filename mapped to a specific command.
Elastic assesses the actors have been active since at least May 2025, distributing off-the-shelf Trojans like Pulsar RAT and Remcos RAT, with the transition to Ethereum smart contracts occurring on May 19, 2026. The group has been linked to seven campaigns since June 16, 2025. As an anti-sandbox measure, the malware attempts to download a page from an unregistered domain; a valid response indicates a sandbox, causing it to crash. Elastic registered the canary domain and identified 1,515 infected systems checking in, over 98% geolocated to Brazil.
Source: The Hackers News