New Brazilian Banking Malware Campaign KREMLIN Deploys Blockchain Infrastructure and Advanced Chrome Extensions to Target Financial Institutions

Cybersecurity researchers have uncovered a sophisticated, previously undocumented Brazilian banking malware campaign that utilizes a versatile attack toolkit designated as KREMLIN. Active since at least May 2025, the threat group—tracked by Elastic Security Labs under the identifier REF9334—has launched multiple targeted campaigns aimed at impersonating more than a dozen major Brazilian financial institutions. By deploying multi-stage JavaScript loaders, custom C++ utilities, and covert browser extensions for Google Chrome and Microsoft Edge, the operators have successfully compromised over 1,500 systems primarily located in South America.

The operation stands out in the contemporary threat landscape due to its innovative integration of blockchain technology. Rather than relying on traditional, easily blockable dynamic DNS providers or hard-coded command-and-control (C2) servers, REF9334 leverages Ethereum smart contracts as dead-drop resolvers. This decentralized approach enables the operators to dynamically update their infrastructure endpoints and payload hosting locations in near real-time, effectively shielding their core operations from standard takedown efforts by law enforcement agencies and cybersecurity firms.

Anatomy of the Attack: From Phishing Lures to Multi-Stage Loaders

The infection chain for the KREMLIN banking malware typically begins with traditional social engineering tactics. Victims receive deceptive lures—often disguised as routine banking notices, overdue invoices, or corporate administrative documents—packaged as malicious JavaScript files. Once a user manually executes the file, the initial script initiates a series of rigorous environmental checks designed to detect whether the code is running within a monitored analysis environment, such as a sandbox or a virtual machine.

If the script identifies indicators of automated analysis, it terminates execution immediately to preserve the stealth of the toolkit. Otherwise, the loader advances to its second stage, which establishes persistence on the host machine via scheduled tasks. This second-stage payload then queries a specific Ethereum smart contract address on the blockchain to retrieve current download locations for subsequent binaries.

Following this retrieval process, the malware downloads a C++ installer that subtly abuses legitimate software binaries—specifically leveraging a SentinelOne component to sideload an unsigned main payload disguised as "SentinelAgentCore.dll." This dynamic-link library performs another layer of anti-analysis checks, scanning running processes against a hard-coded blacklist while evaluating underlying system hardware configurations, such as verifying minimum CPU cores and RAM thresholds. Systems failing to meet these operational parameters are bypassed, ensuring the malware only executes on genuine, high-value enterprise or personal workstations.

Bypassing Chromium Integrity Mechanisms with Phantom Extensions

Once the environmental validations are successfully completed, the KREMLIN installer fetches two primary infrastructure domains—volmira[.]site and zaviro[.]online—from the Ethereum smart contract. It queries the former domain to determine the correct version and identifier of a malicious browser extension designed for Chromium-based browsers, which operates under the guise of an authentic utility named "AVSync System Inc."

Before downloading the extension as a ZIP archive, the malware performs a local check to determine whether the extension is already present on the victim’s browser. If an older version is detected or if no prior installation exists, the archive is retrieved. To install the extension without tripping modern browser security controls, REF9334 employs sophisticated integrity bypass techniques commonly referred to in threat intelligence circles as "Phantom Extension" or "GhostChrome-X" methodologies.

By directly manipulating the browser’s Secure Preferences file and updating the "protection.macs" JSON object with forged cryptographic hashes, the malware successfully registers the unauthorized extension while circumventing native Chromium security protections. This precise technique mirrors methods observed in advanced threat groups globally, highlighting a convergence in modern browser-compromise tactics. Similar strategies have been documented in campaigns involving the China-linked APT31 group, which deployed the BlueMoon exploit kit and the GemStone credential-stealing extension.

Data Exfiltration and Command-and-Control Architecture

Upon successful installation, the KREMLIN browser extension requests extensive permissions, granting the threat actors deep access to browser tabs, active cookies, local storage systems, and web request interception capabilities. The extension generates a unique victim identifier that is persistently stored within the browser profile and appended to all telemetry and data exfiltration packets sent to the primary C2 server at luizestrelhashapr[.]online:443.

Communication between the compromised browser and the infrastructure is maintained primarily through persistent WebSocket channels, supplemented by periodic polling of a "/google_api/" endpoint structured to mimic standard cascading style sheet (CSS) file requests. Through these channels, the extension can receive and execute a wide array of remote commands, enabling the operators to harvest sensitive session tokens, account credentials, and personal identifiable information (PII) as users navigate to target financial portals.

Chronology and Operational Tracking

According to telemetry and analytical reports compiled by Elastic Security Labs, the threat actor group responsible for KREMLIN has demonstrated consistent evolution over an extended period. While the group’s earliest recorded activities date back to May 2025, their operational playbook has continuously adapted. Between June 2025 and mid-2026, the collective was observed orchestrating at least seven distinct campaigns, supplementing their custom browser extension toolkit with off-the-shelf remote access trojans and infostealers, including Pulsar RAT and Remcos RAT.

A critical milestone in the group’s operational security occurred on May 19, 2026, when REF9334 officially transitioned its primary infrastructure resolution mechanism to Ethereum smart contracts. This strategic shift significantly complicated traditional threat intelligence tracking, as blockchain transactions offer a degree of anonymity and persistence that legacy domain registration systems cannot match.

Defensive Intervention and Operational Impact

In an effort to disrupt the campaign’s automated defenses, cybersecurity researchers undertook proactive mitigation steps. Specifically, Elastic Security Labs registered one of the malware’s hard-coded network canary domains—used by the payload to detect network-simulating sandboxes. When the malware attempts to query this canary domain to verify internet connectivity, the registration intercepts the traffic, triggering a safety protocol within the malware that causes it to intentionally crash if an anomaly is detected.

Through this intervention, researchers identified approximately 1,515 distinct infected systems attempting to check into the canary domain. Geospatial analysis of the telemetry revealed that over 98% of the targeted and infected endpoints are concentrated within Brazil, aligning with the campaign’s primary focus on local financial institutions.

While the intervention successfully degraded and manipulated the campaign’s automated defense routines, security analysts emphasize that the core components of the KREMLIN malware remain active on infected endpoints. However, the disruption provides enterprise security teams and incident responders with a crucial window of opportunity to identify compromised hosts, remediate browser-level persistence mechanisms, and harden endpoint security controls before attackers can fully leverage harvested financial credentials.

As financial cybercrime continues to adopt decentralized technologies like blockchain for infrastructure management, security experts stress the urgent need for enhanced visibility into browser extension installations and advanced file integrity monitoring across enterprise networks.