KREMLIN Banking Malware Hijacks Chromium Browsers

Elastic Security Labs has identified a sophisticated Brazilian banking malware operation tracked as REF9334, active since at least May 2025. The campaign delivers a toolkit named KREMLIN that primarily targets financial institutions in Brazil by impersonating local banks through malicious JavaScript lures. The threat actor demonstrates advanced technical maturity by using Ethereum smart contracts as dead-drop resolvers for C2 infrastructure, ensuring resilience against standard domain-based takedowns.

The attack chain involves multi-stage JavaScript loaders, DLL sideloading of legitimate binaries (such as SentinelOne), and the manual installation of malicious Chromium extensions. These extensions bypass browser integrity mechanisms by manipulating 'Secure Preferences' and regenerating cryptographic HMACs and App-Bound encrypted hashes. This allows the actor to steal session tokens, credentials, and capture real-time user input through keylogging and automated web requests.

This threat is high-priority for financial organizations and regional businesses in Brazil. The group's ability to automate the recovery of browser encryption keys and forge integrity checks represents a significant evolution in banking Trojan tradecraft. To date, over 1,500 systems have been identified as infected, with nearly 99% geolocated to Brazil.