Brazilian Banking Malware "KREMLIN" Leverages Blockchain for Stealthy Operations
Cybersecurity researchers at Elastic Security Labs have uncovered a previously undocumented Brazilian banking malware campaign, tracked as REF9334, deploying a sophisticated toolkit called KREMLIN. Active since at least May 2025, the threat actor targets users through phishing lures impersonating 12 Brazilian banks, tricking victims into installing a malicious browser extension on Google Chrome and Microsoft Edge.
The KREMLIN malware ecosystem employs a multi-stage infection chain, including JavaScript loaders, custom C++ installers, and malicious browser extensions, to steal credentials, session tokens, and sensitive data. A key tactic involves bypassing Chromium’s integrity mechanisms by manipulating Secure Preferences and regenerating HMACs and App-Bound encrypted hashes, allowing the extension to evade detection.
A defining feature of the operation is its use of blockchain-based infrastructure. The threat actors leverage Ethereum smart contracts as dead drop resolvers, dynamically updating command-and-control (C2) endpoints and payload hosting locations to avoid disruption. This technique was adopted on May 19, 2026, marking a shift in the group’s evasion strategies.
Infection Chain & Evasion Tactics
The attack begins with a JavaScript file disguised as a banking document, invoice, or corporate file, manually executed by the victim. The malware then deploys a multi-stage loader, which first checks for sandbox or virtual machine environments before proceeding. If the system passes these checks, the loader establishes persistence via a scheduled task and retrieves payload locations from an Ethereum smart contract.
The second stage downloads and executes three key components:
- A malicious browser extension installer
- A .NET PE Injector
- "SentinelMemoryScanner.exe" (a legitimate SentinelOne binary abused for DLL sideloading)
The C++ installer sideloads an unsigned DLL ("SentinelAgentCore.dll") that performs additional evasion checks, including scanning for hard-coded process names and verifying hardware properties (e.g., requiring ≥2 CPUs and >3GB RAM). If these conditions aren’t met, the malware terminates.
Malicious Browser Extension: "AVSync System Inc."
The malware fetches two C2 domains (volmira[.]site and zaviro[.]online) from the Ethereum smart contract, then queries the first to obtain the latest extension version ("1.0.0") and ID ("ndpbidppejfanjbhfgjlohfanbfbklff"). The extension, named "AVSync System Inc.", is installed only if no prior version exists or if an update is detected.
To bypass Secure Preferences protection, KREMLIN uses a publicly documented technique (Phantom Extension/GhostChrome-X), modifying the Secure Preferences file and enabling Chrome’s developer mode to register the extension without triggering security alerts. This method was also observed in a 2026 APT31 campaign exploiting Chrome and Windows zero-days.
Once installed, the extension harvests and exfiltrates browser data including cookies, sessionStorage, localStorage, and tab history to its C2 server (luizestrelhashapr[.]online:443). It also generates a unique victim identifier stored in the browser and supports multiple commands via WebSocket and disguised CSS requests, such as:
- Screenshot capture of active tabs
- Tab enumeration and domain tracking
- Cookie and storage theft
- HTML source extraction
- Dynamic configuration updates
Campaign Scope & Impact
Elastic Security Labs attributes seven distinct campaigns to this threat actor since June 16, 2025, with infections primarily targeting Brazilian users. The malware also distributes off-the-shelf Trojans like Pulsar RAT and Remcos RAT.
To evade analysis, KREMLIN employs a network canary check, attempting to download a page from an unregistered domain. If a response is received (indicating a sandbox), the malware deliberately crashes. Elastic registered the canary domain, identifying 1,515 infected systems, with over 98% located in Brazil.
While the registration temporarily disrupted the campaign’s C2 infrastructure, infected systems remain at risk, requiring remediation efforts to neutralize the threat.
Source: https://thehackernews.com/2026/09/kremlin-banking-malware-hijacks-chrome.html
Google cybersecurity rating report: https://www.rankiteo.com/company/google
SentinelOne cybersecurity rating report: https://www.rankiteo.com/company/sentinelone
"id": "GOOSEN1789503965",
"linkid": "google, sentinelone",
"type": "Cyber Attack",
"date": "5/2025",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'customers_affected': '1,515+ infected systems (98% in '
'Brazil)',
'industry': 'Banking',
'location': 'Brazil',
'name': '12 Brazilian Banks',
'type': 'Financial Institutions'}],
'attack_vector': 'Phishing (Malicious Browser Extension)',
'data_breach': {'data_exfiltration': 'Yes (to C2 servers)',
'number_of_records_exposed': '1,515+ infected systems',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (Banking and personal data)',
'type_of_data_compromised': ['Credentials',
'Session Tokens',
'Cookies',
'localStorage',
'sessionStorage',
'Tab History',
'PII']},
'date_detected': '2025-05-01',
'description': 'Cybersecurity researchers at Elastic Security Labs uncovered '
'a previously undocumented Brazilian banking malware campaign '
'(REF9334) deploying the KREMLIN toolkit. The malware targets '
'users via phishing lures impersonating 12 Brazilian banks, '
'tricking victims into installing a malicious browser '
'extension on Google Chrome and Microsoft Edge. The operation '
'uses Ethereum smart contracts as dead drop resolvers to '
'dynamically update C2 endpoints and payload hosting '
'locations, evading detection.',
'impact': {'data_compromised': 'Credentials, session tokens, cookies, '
'localStorage, sessionStorage, tab history, '
'personally identifiable information (PII)',
'identity_theft_risk': 'High (PII and banking data exposure)',
'operational_impact': 'Potential unauthorized access to banking '
'accounts, data exfiltration',
'payment_information_risk': 'High (Banking credentials and session '
'tokens)',
'systems_affected': 'User endpoints (Windows systems with Google '
'Chrome/Microsoft Edge)'},
'initial_access_broker': {'backdoors_established': 'Malicious browser '
'extension (AVSync System '
'Inc.)',
'entry_point': 'Phishing (Malicious JavaScript '
'files disguised as banking '
'documents/invoices)',
'high_value_targets': 'Brazilian banking customers'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Use of blockchain (Ethereum smart contracts) for C2 '
'infrastructure evasion; abuse of legitimate binaries '
'(SentinelOne) for DLL sideloading; bypass of Chromium’s '
'Secure Preferences via developer mode manipulation.',
'motivation': 'Financial Gain (Banking Credential Theft, Session Token '
'Harvesting)',
'post_incident_analysis': {'corrective_actions': ['Enforce browser extension '
'whitelisting',
'Implement sandboxing for '
'downloaded files',
'Enhance EDR capabilities '
'to detect DLL sideloading',
'Monitor Ethereum smart '
'contracts for malicious C2 '
'updates'],
'root_causes': ['Lack of user awareness (phishing '
'execution)',
'Abuse of legitimate software '
'(SentinelOne binary for DLL '
'sideloading)',
'Bypass of Chromium’s security '
'mechanisms (Secure Preferences '
'manipulation)',
'Use of blockchain for C2 '
'evasion']},
'recommendations': ['Monitor for unauthorized browser extensions',
'Implement strict browser security policies (disable '
'developer mode for non-admin users)',
'Deploy endpoint detection and response (EDR) solutions '
'to detect DLL sideloading',
'Educate users on phishing risks and malicious document '
'execution',
'Block known malicious domains (e.g., volmira[.]site, '
'zaviro[.]online, luizestrelhashapr[.]online)'],
'references': [{'source': 'Elastic Security Labs'}],
'response': {'containment_measures': 'Temporary disruption of C2 '
'infrastructure by registering canary '
'domain',
'remediation_measures': 'Removal of malicious browser extension, '
'system cleanup, credential resets',
'third_party_assistance': 'Elastic Security Labs'},
'threat_actor': 'REF9334 (Brazilian Threat Actor)',
'title': "Brazilian Banking Malware 'KREMLIN' Leverages Blockchain for "
'Stealthy Operations',
'type': 'Malware Campaign',
'vulnerability_exploited': 'Bypass of Chromium’s Secure Preferences and '
'HMAC/App-Bound encrypted hashes'}