KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Elastic Security Labs details KREMLIN, Brazilian banking malware using malicious Chrome/Edge extensions and Ethereum smart contracts to steal credentials and session tokens.
Elastic Security Labs documents KREMLIN (tracked as REF9334), a Brazilian banking malware toolkit active since at least May 2025 that impersonates a dozen Brazilian banks. It uses multi-stage JavaScript loaders, a C++ installer that DLL-sideloads via a legitimate SentinelOne binary, and a malicious Chrome/Edge extension named 'AVSync System Inc.' Ethereum smart contracts act as dead-drop resolvers for C2 endpoints, a shift that occurred May 19, 2026, making infrastructure hard to disrupt. The extension harvests cookies, sessionStorage/localStorage, browsing history, screenshots, and full page HTML via WebSocket plus CSS-disguised polling endpoints. The group has run seven distinct campaigns and also distributes Pulsar RAT and Remcos RAT.
- Malicious Chrome/Edge extensions impersonate a dozen Brazilian banks since May 2025
- Ethereum smart contracts serve as dead-drop resolvers for resilient C2 infrastructure
- C++ installer DLL-sideloads payload via legitimate SentinelOne binary; aborts in sandboxes/VMs
- Extension steals cookies, storage, history, screenshots, and full page HTML
- Same Phantom Extension install technique used by APT31's GemStone campaign in August 2026
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | luizestrelhashapr.online | filtrating browser data for each profile to its C2 server ("luizestrelhashapr[.]online:443") but not before requesting extensive access to brows |
| domain | volmira.site | to the same Ethereum smart contract to fetch two domains – volmira[.]site and zaviro[.]online – and queries the former to obtain th |
| domain | zaviro.online | um smart contract to fetch two domains – volmira[.]site and zaviro[.]online – and queries the former to obtain the browser extension |
From the original article
4 min read at thehackernews.com
Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.