KREMLIN Malware Targets Brazilian Banking Users via Browser Extensions

• •KREMLIN malware targets Brazilian banking users through malicious browser extensions.
• •Over 1,500 infections have been identified, primarily in Brazil.
• •The malware employs Ethereum smart contracts for dynamic command-and-control updates.

Elastic Security Labs has identified a Brazilian banking malware campaign named REF9334, active since May 2025. This campaign utilizes a malicious browser extension called KREMLIN to steal credentials and session tokens from users of Google Chrome and Microsoft Edge. The attackers employ social engineering tactics, using fake banking documents to trick victims into executing malicious JavaScript files. The malware is designed to evade detection by checking for sandbox environments and utilizes Ethereum smart contracts to dynamically update its command-and-control infrastructure. As of now, over 1,500 infections have been reported, with 98% occurring in Brazil. The malware's persistence mechanisms include establishing scheduled tasks and monitoring browser activity. Elastic Security Labs has temporarily disrupted the campaign by registering a kill switch domain, preventing further infections from progressing past initial access.