Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN.
Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and Microsoft Edge.
“The KREMLIN malware ecosystem employs multi-stage JavaScript loaders, custom C++ installers, and malicious browser extensions to steal credentials, session tokens, and sensitive data,” security researchers Cyril François and Andrew Pease said in a technical report shared with The Hacker News.
“Malicious browser extensions bypass Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs, and App-Bound encrypted hashes.”
A defining aspect of the operation is the use of blockchain to conceal the threat actor-controlled infrastructure, leveraging Ethereum smart contracts as dead drop resolvers to dynamically update command-and-control (C2) endpoints and payload hosting locations so that it cannot be disrupted.
The starting point of the KREMLIN is a JavaScript file that masquerades as a banking, invoice, or company document and is manually executed by the victim. In doing so, it leads to the execution of a multi-stage loader that only proceeds if it’s not running within a sandbox or virtual machine, downloading and installing additional payloads before launching the next stage.
The second stage is designed to perform four tasks: establish persistence via a scheduled task, retrieve download locations from an Ethereum smart contract, download the necessary binaries from those locations, and execute the third stage. The payload URLs host the following programs –
- A malicious browser extension installer payload
- .NET PE Injector
- “SentinelMemoryScanner.exe,” a legitimate binary associated with SentinelOne that’s used for DLL sideloading
Specifically, the C++ installer abuses the SentinelOne binary to sideload its unsigned main payload, which impersonates “SentinelAgentCore.dll.” Once launched, the DLL performs similar sandbox and virtual machine evasion checks as the JavaScript loader by scanning the list of running processes and checking machine hardware properties, such as the number of CPUs and RAM capacity.
If any of the running processes matches a name in its hard-coded list, and if the system does not have 2 CPUs or exceed 3 GB RAM, the malware terminates its execution. KREMLIN also reaches out to the same Ethereum smart contract to fetch two domains – volmira[.]site and zaviro[.]online – and queries the former to obtain the browser extension version (“1.0.0”) and ID (“ndpbidppejfanjbhfgjlohfanbfbklff”). The extension goes by the name “AVSync System Inc.”
“Before downloading the archive, the malware checks whether the extension is already installed and, if so, compares the installed version with the version reported by the server,” the researchers said. “It downloads the extension only when no local installation is found, or the versions differ. It then downloads the Chrome extension as a ZIP archive.”
To install the extension on Chromium-based browsers, it makes use of a publicly documented integrity bypass technique called Phantom Extension and GhostChrome-X without triggering the Secure Preferences protection mechanism. The idea is to modify the Secure Preferences file, enable Chrome’s developer mode, and update the “protection.macs” JSON object with forged metadata to register the malicious Chrome extension.
It’s worth noting that the same approach was also adopted by the China-linked APT31 actor in a late August 2026 campaign that leveraged the BlueMoon exploit kit comprising now-patched Chrome and Windows zero-days to install credential-stealing browser extension codenamed GemStone.
Once the extension is installed, KREMLIN begins harvesting and exfiltrating browser data for each profile to its C2 server (“luizestrelhashapr[.]online:443”) but not before requesting extensive access to browser tabs, cookies, storage, and the webRequest API. It also generates a unique victim identifier that’s stashed in the browser’s storage and included in the C2 communications.
The extension supports the following commands after establishing a WebSocket channel with the C2 server –
- Take screenshots of the selected or active tab and upload a compressed image
- Enumerate tabs, domains, and active state, and upload the list
- Steal cookies, sessionStorage, and localStorage from the selected or active tab
- Collect up to 1,000 history entries from the previous 15 days (likely results in failure as the extension manifest lacks the history permission)
- Extract and upload the full HTML source of the selected or active page
- Download attacker-controlled HTML
- Refresh configuration
Besides WebSocket, the extension periodically polls a “/google_api/” endpoint via requests that masquerade as CSS file fetches. Each of these paths is mapped to a specific command –
- 108766d0.css, to upload cookies and storage
- 41f7b187.css, to upload tab IDs, domains, and active-tab state
- b83fa72d.css, to upload compressed browser history from the previous 15 days
- 0f51ad2f.css, to upload a compressed JPEG screenshot, along with page URL and client ID
- e4cce14e.css, to upload compressed full-page HTML, along with page URL and client ID
- 6c0c92f6.css, to upload intercepted request
- 81d47cb6.css, to fetch targeting configuration containing a list of domains and HTTP interception rules
- a98cb43d.css, to fetch redirection rules containing destination URLs
It’s assessed that the actors behind KREMLIN have been active since at least May 2025, including installing malicious browser extensions and distributing off-the-shelf Trojans like Pulsar RAT and Remcos RAT. The transition to Ethereum smart contracts is said to have occurred on May 19, 2026. In all, the group has been attributed to seven distinct campaigns since June 16, 2025.
As part of its anti-sandbox mechanism, the malware performs a network canary check by attempting to download a page from an unregistered domain. Put differently, if it receives a valid response, it likely indicates a sandbox that’s simulating network connectivity. In such a scenario, the malware deliberately crashes.
Elastic said it registered the network canary domain and identified 1,515 infected systems attempting to check into the network canary domain. More than 98% of the systems are geolocated to Brazil.
“So while these systems are still infected with the final component of KREMLIN, this has temporarily degraded and manipulated the campaign’s defense mechanisms and could provide defenders with additional time to identify and remediate infected endpoints,” Elastic said.
