KREMLIN Banking Malware Targets Chromium Browsers in Brazil, Researchers Say

Security researchers have detailed a Brazilian banking malware operation that uses a toolkit known as KREMLIN to install malicious extensions in Google Chrome and Microsoft Edge. Elastic Security Labs, which tracks the activity as REF9334, said the campaign has been active since at least May 2025 and primarily uses lures posing as bank, invoice, or business documents.

Victims who manually run the disguised JavaScript files trigger a multi-stage infection chain. The malware checks for virtual machines and sandbox environments before downloading additional components, establishing persistence through scheduled tasks, and retrieving infrastructure details from an Ethereum smart contract.

The use of blockchain-based smart contracts allows the operators to update command-and-control and payload-hosting locations without relying on a fixed set of conventional servers. Elastic said the group appears to have adopted this mechanism in May 2026.

Browser extension installation

The final stages include a custom installer and a malicious browser extension named “AVSync System Inc.” The installer reportedly abuses a legitimate SentinelOne-associated executable for DLL sideloading, loading an unsigned DLL disguised as a security-related component.

To add the extension to Chromium-based browsers, KREMLIN modifies browser preference files and related integrity data. Researchers said this method can register the extension while bypassing protections intended to prevent unauthorized changes to Chrome extension settings.

Once installed, the extension requests broad permissions that can provide access to tabs, cookies, browser storage, and web requests. It can reportedly collect credentials-related session information, page content, screenshots, active-tab details, and potentially browser history. The stolen information is transmitted to attacker-controlled infrastructure through WebSocket communications and requests made to paths designed to resemble CSS resources.

Brazil-focused activity

Elastic linked the operation to lures impersonating roughly a dozen Brazilian financial institutions. The researchers also identified earlier activity involving malicious extensions and commodity remote-access tools, including Pulsar RAT and Remcos RAT.

As part of its evasion behavior, KREMLIN attempts to contact an unregistered domain to determine whether network traffic is being simulated in an analysis environment. Elastic registered that domain and observed 1,515 systems attempting the check-in; more than 98% appeared to be located in Brazil.

• Organizations should review browser extension inventories and remove unapproved add-ons.
• Security teams should investigate unexpected changes to Chromium Secure Preferences files.
• Users should avoid opening JavaScript attachments or document files received through unsolicited messages.