KREMLIN Malware Uses Blockchain and Browser Extensions to Steal Brazilian Banking Credentials
A new Brazilian banking malware operation, tracked as REF9334, is distributing a toolkit named KREMLIN. Active since May 2025, the malware targets Chrome and Edge users by impersonating banks and installing malicious browser extensions to steal credentials and session tokens.
A sophisticated new banking malware operation, dubbed KREMLIN and tracked by Elastic Security Labs as REF9334, has been actively targeting users in Brazil since at least May 2025. This operation employs a multi-stage attack chain involving JavaScript loaders, custom C++ installers, and malicious browser extensions designed to pilfer credentials, session tokens, and other sensitive data from victims.
The KREMLIN malware's unique approach involves leveraging blockchain technology, specifically Ethereum smart contracts, to obscure its command-and-control (C2) infrastructure. This allows the threat actors to dynamically update C2 endpoints and payload hosting locations, making disruption significantly more challenging for security researchers.
The initial infection vector typically begins with a JavaScript file masquerading as a legitimate document, such as a banking or invoice notification. This file is manually executed by the victim and acts as a multi-stage loader. Crucially, it includes checks to evade sandboxes and virtual machines, ensuring its malicious activities are only carried out on genuine user systems.
Upon successful evasion, the loader establishes persistence through a scheduled task and then queries an Ethereum smart contract to retrieve download locations for subsequent payloads. These payloads include a malicious browser extension installer, a .NET PE Injector, and a legitimate SentinelOne binary. The operation cleverly abuses the SentinelOne binary to sideload its primary unsigned payload, which impersonates a "SentinelAgentCore.dll."
Once active, the KREMLIN malware performs further evasion by scanning running processes and checking system hardware properties like CPU count and RAM. If the environment appears suspicious or lacks sufficient resources (e.g., fewer than 2 CPUs or less than 3 GB RAM), the malware self-terminates. It then contacts the same Ethereum smart contract to fetch C2 domains and retrieve the version and ID for its malicious browser extension, which deceptively identifies itself as "AVSync System Inc."
To install the malicious extension on Chromium-based browsers like Chrome and Edge, KREMLIN utilizes a technique known as Phantom Extension or GhostChrome-X. This method bypasses Chromium's integrity mechanisms by manipulating the Secure Preferences file, enabling developer mode, and forging metadata to register the extension without triggering security alerts. This tactic bears resemblance to a campaign by the APT31 actor in late 2026, which also used a similar technique with a credential-stealing browser extension.
Once installed, the "AVSync System Inc." extension establishes a WebSocket channel with the C2 server to harvest and exfiltrate browser data. It requests extensive permissions, including access to tabs, cookies, storage, and the webRequest API. The extension can perform various malicious actions, such as taking screenshots, stealing cookies and session storage, enumerating tabs and domains, and even attempting to collect browsing history, although the latter may be limited by manifest permissions.
The KREMLIN operation has also been observed distributing other off-the-shelf Trojans like Pulsar RAT and Remcos RAT, indicating a broad toolkit for cybercriminals. The shift to using Ethereum smart contracts for C2 infrastructure, noted around May 2026, signifies an evolving and increasingly resilient threat landscape for banking malware targeting Brazilian users.