Cybersecurity researchers have uncovered a previously unknown Brazilian banking malware operation that deploys a toolkit named KREMLIN, targeting users through fake bank websites and malicious browser extensions on Chrome and Edge. Elastic Security Labs disclosed the findings in a technical report shared with The Hacker News, tracking the activity under the designation REF9334. The operation has been active since at least May 2025 and employs Ethereum smart contracts to hide command-and-control servers, making disruption significantly harder.
The malware campaign begins with JavaScript files disguised as banking, invoice, or company documents that victims manually execute, according to the report. The infection proceeds through multiple stages: first establishing persistence via scheduled tasks, then retrieving payload locations from an Ethereum smart contract, downloading necessary binaries including a malicious browser extension installer and a .NET PE injector, and finally executing the next phase. The operation impersonates more than a dozen Brazilian financial institutions and leverages a legitimate SentinelOne binary called "SentinelMemoryScanner.exe" for DLL sideloading to evade detection. The malicious browser extension, which identifies itself as "AVSync System Inc.," installs itself by manipulating Chrome's Secure Preferences file using publicly documented integrity bypass techniques called Phantom Extension and GhostChrome-X. Once installed, the extension harvests browser data including credentials, session tokens, cookies, sessionStorage, localStorage, and can capture screenshots, extract full HTML sources, and steal up to 1,000 history entries from the previous 15 days. Elastic Security Labs registered a network canary domain that the malware uses for anti-sandbox checks and identified 1,515 infected systems attempting to connect, with more than 98% geolocated to Brazil.
"The KREMLIN malware ecosystem employs multi-stage JavaScript loaders, custom C++ installers, and malicious browser extensions to steal credentials, session tokens, and sensitive data," security researchers Cyril François and Andrew Pease stated in the technical report. The malware performs sophisticated evasion checks by scanning running processes and examining machine hardware properties such as CPU count and RAM capacity, terminating execution if it detects fewer than 2 CPUs or less than 3 GB RAM. The threat actors have been attributed to seven distinct campaigns since June 16, 2025, and transitioned to using Ethereum smart contracts for infrastructure concealment on May 19, 2026. The group has also distributed off-the-shelf remote access trojans including Pulsar RAT and Remcos RAT as part of their broader operations.
The use of blockchain technology as dead drop resolvers represents a significant evolution in how threat actors protect their infrastructure from takedown efforts, the report explains. The Ethereum smart contracts dynamically update command-and-control endpoints and payload hosting locations, preventing security teams from disrupting operations even when they identify malicious infrastructure. The malicious extension also employs a clever network canary check by attempting to download a page from an unregistered domain—if it receives a valid response, the malware assumes it's running in a sandbox simulating network connectivity and deliberately crashes. By registering the network canary domain, Elastic Security Labs has temporarily degraded the campaign's defense mechanisms, potentially providing defenders with additional time to identify and remediate infected endpoints. The malware's ability to bypass Chromium integrity mechanisms by regenerating required HMACs and App-Bound encrypted hashes demonstrates the increasing sophistication of banking trojans targeting Brazilian financial institutions. Organizations should prioritize monitoring for unusual browser extension installations, particularly those modifying Secure Preferences files or operating in developer mode, and implement network-level detection for connections to suspicious domains hosting malicious payloads. The threat landscape continues to shift as adversaries adopt decentralized technologies that fundamentally challenge traditional takedown strategies, forcing security teams to rethink how they approach infrastructure disruption.