KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Summary

A new Brazilian banking malware operation, tracked as REF9334 and dubbed KREMLIN, is actively stealing credentials and session tokens from users of Google Chrome and Microsoft Edge. The malware employs multi-stage JavaScript loaders, custom installers, and malicious browser extensions that bypass security mechanisms. Notably, it leverages Ethereum smart contracts to dynamically update C2 infrastructure, making it resilient to disruption.

Full text

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens Ravie LakshmananSep 15, 2026Cybercrime / Browser Security Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and Microsoft Edge. "The KREMLIN malware ecosystem employs multi-stage JavaScript loaders, custom C++ installers, and malicious browser extensions to steal credentials, session tokens, and sensitive data," security researchers Cyril François and Andrew Pease said in a technical report shared with The Hacker News. "Malicious browser extensions bypass Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs, and App-Bound encrypted hashes." A defining aspect of the operation is the use of blockchain to conceal the threat actor-controlled infrastructure, leveraging Ethereum smart contracts as dead drop resolvers to dynamically update command-and-control (C2) endpoints and payload hosting locations so that it cannot be disrupted. The starting point of the KREMLIN is a JavaScript file that masquerades as a banking, invoice, or company document and is manually executed by the victim. In doing so, it leads to the execution of a multi-stage loader that only proceeds if it's not running within a sandbox or virtual machine, downloading and installing additional payloads before launching the next stage. The second stage is designed to perform four tasks: establish persistence via a scheduled task, retrieve download locations from an Ethereum smart contract, download the necessary binaries from those locations, and execute the third stage. The payload URLs host the following programs - A malicious browser extension installer payload .NET PE Injector "SentinelMemoryScanner.exe," a legitimate binary associated with SentinelOne that's used for DLL sideloading Specifically, the C++ installer abuses the SentinelOne binary to sideload its unsigned main payload, which impersonates "SentinelAgentCore.dll." Once launched, the DLL performs similar sandbox and virtual machine evasion checks as the JavaScript loader by scanning the list of running processes and checking machine hardware properties, such as the number of CPUs and RAM capacity. If any of the running processes matches a name in its hard-coded list, and if the system does not have 2 CPUs or exceed 3 GB RAM, the malware terminates its execution. KREMLIN also reaches out to the same Ethereum smart contract to fetch two domains – volmira[.]site and zaviro[.]online – and queries the former to obtain the browser extension version ("1.0.0") and ID ("ndpbidppejfanjbhfgjlohfanbfbklff"). The extension goes by the name "AVSync System Inc." "Before downloading the archive, the malware checks whether the extension is already installed and, if so, compares the installed version with the version reported by the server," the researchers said. "It downloads the extension only when no local installation is found, or the versions differ. It then downloads the Chrome extension as a ZIP archive." To install the extension on Chromium-based browsers, it makes use of a publicly documented integrity bypass technique called Phantom Extension and GhostChrome-X without triggering the Secure Preferences protection mechanism. The idea is to modify the Secure Preferences file, enable Chrome's developer mode, and update the "protection.macs" JSON object with forged metadata to register the malicious Chrome extension. It's worth noting that the same approach was also adopted by the China-linked APT31 actor in a late August 2026 campaign that leveraged the BlueMoon exploit kit comprising now-patched Chrome and Windows zero-days to install credential-stealing browser extension codenamed GemStone. Once the extension is installed, KREMLIN begins harvesting and exfiltrating browser data for each profile to its C2 server ("luizestrelhashapr[.]online:443") but not before requesting extensive access to browser tabs, cookies, storage, and the webRequest API. It also generates a unique victim identifier that's stashed in the browser's storage and included in the C2 communications. The extension supports the following commands after establishing a WebSocket channel with the C2 server - Take screenshots of the selected or active tab and upload a compressed image Enumerate tabs, domains, and active state, and upload the list Steal cookies, sessionStorage, and localStorage from the selected or active tab Collect up to 1,000 history entries from the previous 15 days (likely results in failure as the extension manifest lacks the history permission) Extract and upload the full HTML source of the selected or active page Download attacker-controlled HTML Refresh configuration Besides WebSocket, the extension periodically polls a "/google_api/" endpoint via requests that masquerade as CSS file fetches. Each of these paths is mapped to a specific command - 108766d0.css, to upload cookies and storage 41f7b187.css, to upload tab IDs, domains, and active-tab state b83fa72d.css, to upload compressed browser history from the previous 15 days 0f51ad2f.css, to upload a compressed JPEG screenshot, along with page URL and client ID e4cce14e.css, to upload compressed full-page HTML, along with page URL and client ID 6c0c92f6.css, to upload intercepted request 81d47cb6.css, to fetch targeting configuration containing a list of domains and HTTP interception rules a98cb43d.css, to fetch redirection rules containing destination URLs It's assessed that the actors behind KREMLIN have been active since at least May 2025, including installing malicious browser extensions and distributing off-the-shelf Trojans like Pulsar RAT and Remcos RAT. The transition to Ethereum smart contracts is said to have occurred on May 19, 2026. In all, the group has been attributed to seven distinct campaigns since June 16, 2025. As part of its anti-sandbox mechanism, the malware performs a network canary check by attempting to download a page from an unregistered domain. Put differently, if it receives a valid response, it likely indicates a sandbox that's simulating network connectivity. In such a scenario, the malware deliberately crashes. Elastic said it registered the network canary domain and identified 1,515 infected systems attempting to check into the network canary domain. More than 98% of the systems are geolocated to Brazil. "So while these systems are still infected with the final component of KREMLIN, this has temporarily degraded and manipulated the campaign's defense mechanisms and could provide defenders with additional time to identify and remediate infected endpoints," Elastic said. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  browser security, Cybercrime, Malware, Web Security ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let

Indicators of Compromise

• domain — volmira[.]site
• domain — zaviro[.]online

Entities