Cybersecurity experts have unveiled a new wave of Brazilian banking malware known as KREMLIN, which is targeting online users by infiltrating popular web browsers like Chrome and Edge. This malicious campaign, tracked by Elastic Security Labs under the name REF9334, has been active since May 2025. The attackers employ deceptive tactics by posing as representatives from various Brazilian banks and install harmful browser extensions to compromise user credentials and session tokens.
Complex Attack Mechanisms
KREMLIN operates through a sophisticated system of JavaScript loaders, C++ installers, and browser extensions to pilfer sensitive information. Researchers Cyril François and Andrew Pease from Elastic Security Labs highlight how these extensions bypass security features by altering secure preferences and generating necessary HMACs. Additionally, the attackers use blockchain technology to obscure their operations, utilizing Ethereum smart contracts to update command-and-control servers dynamically.
The initial phase of the attack begins with a JavaScript file disguised as a legitimate document, which, when executed, triggers a multi-stage process. This sequence only continues if the malware detects it’s outside a sandbox or virtual environment, thereby installing additional payloads.
Stages of the Attack
In the subsequent phases, the malware establishes persistence, retrieves download links from Ethereum smart contracts, and executes the next stage with additional binaries. These binaries include a browser extension installer, a .NET PE injector, and a legitimate binary used for DLL sideloading.
The C++ installer exploits a SentinelOne binary to sideload its main payload, which mimics a legitimate DLL file. This payload further ensures it is not in a sandbox by checking running processes and system configurations, such as CPU and RAM specifications.
Malware Functionality and Reach
Once installed, the KREMLIN extension accesses browser data and communicates with a command server for data exfiltration. It employs various commands to capture screenshots, enumerate tabs, and steal cookies and local storage data. The malware also uses a technique called Phantom Extension to bypass integrity checks and install itself without alerting security mechanisms.
KREMLIN’s reach is extensive, with over 1,500 systems identified as infected, predominantly in Brazil. The malware periodically polls a server disguised as fetching CSS files to execute commands, such as uploading cookies or browser history.
Future Implications
The ongoing sophistication of the KREMLIN malware underscores the evolving nature of cyber threats against financial institutions and end-users. While efforts are underway to disrupt these campaigns, the use of blockchain and sophisticated evasion techniques pose significant challenges. Security teams must remain vigilant, employing advanced measures to detect and mitigate these threats effectively.
Elastic Security Labs continues to monitor KREMLIN’s activities, providing crucial insights into its operations and methodologies. The need for robust cybersecurity defenses and continuous monitoring has never been more critical as attackers refine their techniques to bypass existing safeguards.
