KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Summary: Elastic Security Labs documented a Brazilian banking malware operation tracked as REF9334, active since at least May 2025, that uses lures impersonating a dozen Brazilian banks to install a malicious Chrome and Edge extension called KREMLIN, which steals credentials, session tokens, and browser data. The toolkit uses multi-stage JavaScript loaders, a C++ installer that sideloads an unsigned payload through the SentinelOne binary, and Ethereum smart contracts as dead drop resolvers to update command-and-control endpoints, with the switch to smart contracts occurring on May 19, 2026.
Bottom line: Elastic registered the malware's network canary domain and found 1,515 infected systems checking in, more than 98% of them in Brazil - a population of compromised endpoints whose browser sessions and tokens are already in the actor's hands.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026