The KREMLIN banking malware campaign is an important example of how financial malware is evolving beyond conventional credential theft and moving directly into the browser, where authentication, banking sessions and sensitive application data already exist. The campaign, tracked as REF9334 and active since at least May 2025, targets users with lures impersonating Brazilian banks, invoices and corporate documents before installing a malicious extension into Google Chrome and Microsoft Edge. Once present, the extension can access cookies, sessionStorage, localStorage, open tabs, page contents and screenshots, giving the attacker visibility into what the victim is doing inside authenticated browser sessions rather than simply collecting credentials at the moment they are entered.

This distinction matters because stealing a password and stealing an authenticated session are very different security problems. A password is normally protected by additional controls such as multi-factor authentication, device checks and risk-based login policies, but a valid session token represents a user who has already passed those controls. If malware can obtain cookies and browser storage associated with an authenticated banking or cloud session, attackers may be able to bypass part of the login process entirely and operate inside a session that the service already considers trusted. This is why session theft has become increasingly attractive to attackers and why organisations need to protect browser state with the same seriousness historically reserved for passwords.

KREMLIN’s malicious browser extension is particularly powerful because it is not limited to passive data collection. The extension establishes a WebSocket connection with command-and-control infrastructure and can receive instructions to take screenshots, enumerate tabs, steal cookies and storage data, extract the full HTML source of active pages, download attacker-controlled HTML and apply interception or redirection rules. That effectively gives the attacker a programmable position inside the browser, allowing them to observe, modify and potentially manipulate the victim’s interaction with banking websites in real time.

The malware’s ability to extract the full HTML of a banking page is especially significant because it gives attackers access not only to visible information but potentially to account balances, transaction details, beneficiary information and other data rendered inside authenticated sessions. Combined with screenshots and storage theft, the attacker can construct a detailed picture of the victim’s financial activity. This turns the browser into a remote intelligence collection platform rather than merely a place where credentials happen to be entered.

The installation technique makes the campaign even more interesting because the attackers bypass Chromium’s extension integrity protections rather than simply asking users to install an obviously suspicious add-on. KREMLIN modifies Chrome’s Secure Preferences data, enables developer mode and regenerates the metadata required to make the malicious extension appear valid to the browser. This allows the extension to be installed outside the official browser store while avoiding the normal integrity protections intended to detect unauthorised modifications. It is another reminder that browser-extension security cannot rely solely on whether an extension appears in the Chrome Web Store because attackers with endpoint access can sometimes manipulate the browser configuration itself.

The same technique has recently appeared in other sophisticated campaigns, which suggests that manipulation of Chromium extension integrity is becoming an increasingly attractive post-compromise technique. Once attackers gain execution on an endpoint, implanting a browser extension gives them direct access to authenticated web applications without needing to repeatedly compromise each individual service. In modern enterprises, where employees spend much of their working day inside browsers accessing SaaS platforms, email, financial systems and cloud applications, a compromised browser extension can effectively become a universal access point into the user’s digital working environment.

The initial execution chain is also worth examining because the attack still depends on social engineering. Victims receive JavaScript files disguised as banking, invoice or company documents and must manually execute them. Once launched, the script performs anti-sandbox checks and begins a multi-stage installation process. This demonstrates that sophisticated malware does not necessarily require sophisticated delivery; attackers often combine ordinary user deception with advanced post-exploitation techniques because convincing one person to run a file can still be easier than developing a new remote exploit.

The malware also shows considerable effort to avoid automated analysis. It checks running processes, CPU count and available RAM to identify sandboxes and virtual machines, terminating itself when the environment appears suspicious. It even performs a network canary test using an unregistered domain, reasoning that a valid response may indicate a security sandbox simulating internet connectivity. This behaviour demonstrates how attackers increasingly design malware specifically to recognise the environments defenders use to analyse it, creating a continuous cycle in which malware attempts to distinguish real victims from research systems.

One of the most innovative aspects of KREMLIN is its use of Ethereum smart contracts as a dead-drop resolver for command-and-control information. Instead of hard-coding the address of its infrastructure directly into the malware, the operators store information in a smart contract that can be queried to discover the current locations of payloads and C2 servers. This makes disruption more difficult because defenders cannot simply take down one domain or IP address and permanently break the malware’s infrastructure. The attacker can update the information stored through the blockchain mechanism and redirect infected systems toward new infrastructure.

This technique illustrates how legitimate decentralized technologies can provide attackers with operational resilience. Blockchain itself is not malicious, but its distributed and tamper-resistant characteristics can make it useful for malware operators who want an infrastructure layer that defenders cannot easily seize or modify. Similar concepts have previously been seen with DNS, cloud storage, social-media platforms and public code repositories: attackers increasingly prefer to hide command-and-control information inside services that defenders cannot simply block without affecting legitimate users.

KREMLIN also abuses a legitimate SentinelOne executable for DLL side-loading, demonstrating another increasingly common attack technique in which trusted signed software is used as the launcher for malicious code. The malware places a malicious DLL where the legitimate application expects to load a library, causing the signed executable to execute the attacker’s code. To security controls that rely heavily on executable reputation or digital signatures, the parent process may appear completely legitimate even though malicious code is running inside the process context.

This is an important reminder that code signing establishes the origin of a binary but does not guarantee the behaviour of every library that binary may subsequently load. Attackers routinely exploit this gap because trusted applications provide camouflage and may receive less scrutiny from endpoint controls. Effective detection therefore needs to evaluate process behaviour, library-loading paths and execution context rather than assuming that a signed process is automatically trustworthy.

The campaign’s concentration in Brazil also provides useful context. Elastic registered the malware’s network-canary domain and observed 1,515 infected systems connecting to it, with more than 98% geolocated in Brazil. That strongly supports the conclusion that the campaign is focused on Brazilian users and financial institutions rather than being a generic global malware operation. The targeting strategy is further reinforced by phishing lures impersonating approximately a dozen Brazilian banks, showing that attackers invest in regional knowledge and local brands when the potential financial return justifies the effort.

The banking focus also demonstrates why browser-level monitoring should become an important part of fraud detection. A financial institution may see a valid customer login from a familiar device with the correct credentials and an existing session cookie, yet the actions inside that session may actually be influenced or controlled by malware. Traditional authentication therefore provides only part of the security picture. Behavioural signals such as unusual beneficiary creation, transaction patterns, navigation sequences and device behaviour can help identify fraud that occurs after authentication has already succeeded.

For enterprises, KREMLIN provides a broader warning because the same techniques used against banking sessions can also target corporate SaaS platforms. Browser cookies and local storage can contain authentication material for email, CRM systems, collaboration platforms and cloud consoles. A malicious extension capable of extracting those artifacts could potentially move from financial fraud into enterprise account takeover. Organisations should therefore treat malicious browser extensions as endpoint threats with consequences far beyond browser configuration.

Browser-extension governance is consequently becoming increasingly important. Enterprises should maintain an allowlist of approved extensions, restrict developer mode where appropriate and monitor for extensions installed outside trusted channels. Security teams should also inventory extension IDs across managed devices and alert when new extensions suddenly appear across sensitive user groups. The browser has become too central to business operations to leave extension installation entirely to individual user discretion.

Endpoint detection can also help by identifying behaviours associated with KREMLIN’s installation process, such as unexpected modification of Chromium Secure Preferences, unusual scheduled tasks, DLL side-loading involving trusted executables and JavaScript interpreters launching downloaders or binaries. These behavioural signals remain valuable even when malware components or domains change because they describe what the attack is doing rather than relying only on static indicators that attackers can replace.

Network monitoring remains useful as well, especially when correlated with endpoint context. KREMLIN establishes WebSocket communications and periodically polls endpoints disguised as CSS file requests, using different paths for different commands such as cookie theft, screenshots and page extraction. Individually, requests for CSS resources may look harmless, but repeated structured requests from an endpoint that has recently modified browser configuration should be highly suspicious. Context turns ordinary-looking network traffic into meaningful detection signals.

The campaign also illustrates why financial malware is increasingly difficult to classify using old categories. KREMLIN contains elements of a banking trojan, browser stealer, remote access tool and post-exploitation framework. Its purpose is clearly financial, but its capabilities extend well beyond simple form grabbing. Security teams therefore need to focus less on malware labels and more on capabilities: browser control, token theft, persistence, remote tasking, page manipulation and command execution.

The transition to Ethereum-based infrastructure in May 2026 further demonstrates that the campaign continues to evolve. Threat actors rarely build complex infrastructure unless they expect to maintain operations over time, and the use of blockchain as a resilient configuration mechanism suggests an intention to survive takedowns and infrastructure disruptions. Defenders should therefore assume that blocking the domains identified in one report may provide only temporary relief if the malware can dynamically discover replacement endpoints.

For users, the immediate lesson remains painfully simple: unexpected JavaScript files masquerading as invoices, banking documents or business files should never be executed. Modern Windows environments should ideally prevent ordinary users from freely executing script files received through email or downloads, especially where business workflows do not require it. Application control and script restrictions can eliminate entire categories of initial-access techniques before the more sophisticated malware stages ever have an opportunity to run.

The broader cybersecurity lesson from KREMLIN is that identity security increasingly depends on protecting what happens after authentication. Passwords and MFA remain essential, but the browser contains the session state proving that authentication has already occurred, making it an exceptionally valuable target. Attackers who control the browser may not need to defeat the login process at all; they can simply observe or manipulate the authenticated session that already exists.

Ultimately, KREMLIN demonstrates why browser security must be treated as endpoint and identity security rather than merely web security. Chrome and Edge are no longer simple applications for displaying websites; they are where users authenticate, communicate, bank, access cloud systems and conduct much of their working lives. A malicious extension with access to cookies, storage, page content and network requests can therefore become one of the most privileged pieces of software on the endpoint. Protecting the browser, its extensions and its authenticated sessions is increasingly as important as protecting the operating system itself.

Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and

Source: KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens via The Hacker News — published 15 Sep 2026.