A previously undocumented Brazilian banking malware operation has been uncovered by cybersecurity researchers, revealing a toolkit called KREMLIN.
Known as REF9334, the threat actor behind this operation has been active since at least May 2025. They have been using phishing lures impersonating various Brazilian banks to distribute a malicious browser extension on Google Chrome and Microsoft Edge.
According to security researchers Cyril François and Andrew Pease, the KREMLIN malware ecosystem utilizes multi-stage JavaScript loaders, custom C++ installers, and malicious browser extensions to steal sensitive data and credentials. These malicious browser extensions are designed to bypass Chromium integrity mechanisms by manipulating Secure Preferences and using App-Bound encrypted hashes.
One unique aspect of this operation is the use of blockchain technology to hide the threat actor-controlled infrastructure. Ethereum smart contracts are leveraged as dead drop resolvers to update command-and-control (C2) endpoints and payload hosting locations dynamically.
The malware operation begins with a JavaScript file disguised as a banking or company document, which, when executed, triggers a multi-stage loader to download additional payloads. These payloads include a malicious browser extension installer, a .NET PE Injector, and a legitimate binary called “SentinelMemoryScanner.exe” used for DLL sideloading.
The C++ installer abuses the SentinelOne binary to sideload its main payload, impersonating “SentinelAgentCore.dll.” This payload performs evasion checks to avoid running in a sandbox or virtual machine.
Once the extension is installed on Chromium-based browsers, it starts collecting and exfiltrating browser data to a command-and-control server. The extension supports various commands, such as taking screenshots, stealing cookies, and uploading browser history.
The actors behind KREMLIN have been active since at least May 2025 and have been involved in distributing other Trojans like Pulsar RAT and Remcos RAT. They transitioned to using Ethereum smart contracts on May 19, 2026. The group has been linked to seven distinct campaigns since June 16, 2025.
As part of its anti-sandbox mechanism, the malware performs a network canary check to detect sandbox environments. Elastic Security Labs identified 1,515 infected systems attempting to check into the network canary domain, with the majority located in Brazil.
Elastic Security Labs has taken steps to disrupt the campaign by registering the network canary domain, providing defenders with additional time to identify and remediate infected endpoints.
