KREMLIN Banking Malware Targets Brazilian Users via Malicious Browser Extensions

• •KREMLIN malware targets Brazilian banking users through malicious browser extensions.
• •The operation has been active since May 2025, with over 1,500 infections reported.
• •Attackers utilize Ethereum smart contracts to dynamically update their command-and-control infrastructure.

Elastic Security Labs has identified a Brazilian banking malware operation named KREMLIN, active since May 2025, targeting users through malicious browser extensions on Chrome and Edge. The malware employs multi-stage JavaScript loaders and custom C++ installers to steal credentials and session tokens. Attackers use lures impersonating twelve Brazilian banks and leverage Ethereum smart contracts to conceal their infrastructure and dynamically update command-and-control endpoints. The KREMLIN operation has been tracked through seven campaigns over 15 months, disrupting over 1,500 infections so far. The malware's infection chain begins with a JavaScript file disguised as a banking document, leading to the installation of a malicious browser extension. This extension bypasses Chromium's integrity mechanisms, posing a significant threat to Brazilian financial institutions and users. Current efforts are underway to mitigate the impact of this malware.