New Brazilian Banking Malware Operation KREMLIN Uses Blockchain Infrastructure and Advanced Browser Exploits to Target Financial Institutions

Cybersecurity researchers have uncovered a sophisticated, previously undocumented financial malware operation targeting Brazilian banking customers. Tracked by Elastic Security Labs under the moniker REF9334, this evolving threat actor has been actively deploying a malicious toolkit known as KREMLIN since at least May 2025. The campaign leverages carefully crafted social engineering lures impersonating more than a dozen major Brazilian financial institutions. Its ultimate objective is the deployment of a malicious browser extension designed to covertly intercept sensitive user data, authentication credentials, and session tokens directly within Google Chrome and Microsoft Edge environments.

According to a technical analysis published by Elastic Security Labs researchers Cyril François and Andrew Pease, the KREMLIN ecosystem relies on a modular architecture. This framework integrates multi-stage JavaScript loaders, custom C++ installers, and specialized browser extensions designed to circumvent standard browser integrity protections. Most notably, the campaign utilizes decentralized blockchain technology—specifically Ethereum smart contracts—to obscure its command-and-control (C2) infrastructure, rendering traditional takedown efforts exceptionally difficult for law enforcement and incident responders.

The Attack Chain: From Initial Lure to Execution

The KREMLIN infection vector typically initiates when a target manually executes a malicious JavaScript file disguised as a routine banking statement, a corporate invoice, or an official administrative document. Upon execution, the script verifies whether it is operating within a sandbox environment or a virtual machine. If virtualization artifacts are detected, the payload automatically terminates to thwart automated malware analysis by security software.

Once the environment is deemed safe, the loader proceeds to the second stage of the attack. This phase accomplishes four critical objectives: establishing persistence via scheduled system tasks, querying a designated Ethereum smart contract functioning as a dead drop resolver, downloading the necessary binaries from decentralized or dynamic locations, and launching the subsequent C2 communication stage.

The C++ installer component exhibits notable evasion tactics, including the sideloading of an unsigned main payload by abusing a legitimate SentinelOne binary structure, masquerading as "SentinelAgentCore.dll." This component conducts secondary environmental checks, scanning running processes against a hard-coded blacklist and evaluating system resources—such as verifying a minimum threshold of CPU cores and RAM capacity—to ensure the host is a genuine user machine rather than an analyst workstation or automated sandbox.

Blockchain C2 Architecture and Anti-Analysis Safeguards

A defining characteristic of the REF9334 operation is its innovative use of Ethereum smart contracts to dynamically manage infrastructure. Rather than relying on hard-coded static domains or IP addresses that can be rapidly blocked by security vendors, the KREMLIN malware queries a specific Ethereum blockchain address to retrieve up-to-date payload hosting locations and C2 endpoint configurations.

This decentralized approach provides the threat actors with unprecedented operational resilience. Even if individual hosting providers or domains are seized or blacklisted, the operators can update the smart contract state to point to fresh infrastructure without modifying the underlying malware binaries already deployed on victim endpoints.

Further complicating detection efforts, the malware incorporates a sophisticated network canary check. During the initialization phase, the payload attempts to fetch a web page from a specifically monitored, unregistered domain. If the malware receives a valid response—an indicator that a sandbox environment is artificially simulating internet connectivity—it deliberately crashes.

Security researchers at Elastic leveraged this behavioral quirk by registering the canary domain themselves. This strategic move allowed them to monitor connection attempts and identify approximately 1,515 infected systems worldwide, with an overwhelming 98% concentration of targeted hosts geolocated in Brazil. Although these compromised machines still harbor the final stages of the KREMLIN payload, the intervention temporarily disrupted the campaign’s defense mechanisms, providing defenders with a critical window to isolate and remediate infected endpoints.

Browser Hijacking via Phantom Extension Techniques

Once the environmental checks are successfully passed, the KREMLIN installer queries its infrastructure to download a version-controlled browser extension archive (ZIP format) identified under the guise of "AVSync System Inc." (extension ID: ndpbidppejfanjbhfgjlohfanbfbklff). Before initiating the download, the malware checks the local system to see if the extension is already present, ensuring synchronization with the server’s current version index.

To force the installation of the extension on Chromium-based browsers without alerting the user or triggering native security warnings, the malware employs advanced integrity bypass methodologies known in the security community as "Phantom Extension" and "GhostChrome-X techniques." These methods manipulate the browser’s internal Secure Preferences file and enable developer mode discreetly. By regenerating the required HMACs and App-Bound encrypted hashes within the JSON metadata (protection.macs), the threat actors bypass Chromium integrity checks that typically prevent unauthorized sideloading of extensions.

This technique mirrors sophisticated supply-chain and espionage operations observed in other high-profile campaigns. For instance, similar mechanisms were documented in late August 2026, when a China-linked threat cluster tracked as APT31 utilized the BlueMoon exploit kit to deploy credential-stealing browser extensions codenamed GemStone.

Data Exfiltration and Command Capabilities

Following successful deployment within Google Chrome or Microsoft Edge, the malicious extension requests sweeping permissions, including access to browser tabs, cookies, local storage, and the webRequest API. It generates a unique victim identifier, stores it locally, and establishes a persistent WebSocket connection to a primary C2 server (luizestrelhashapr[.]online:443).

The extension is architected to execute a wide variety of remote commands issued by the operators over the WebSocket channel. Additionally, it implements a secondary polling mechanism, querying a /google_api/ endpoint using requests intentionally disguised as routine Cascading Style Sheet (CSS) file fetches. Each specific URI path maps to discrete operational commands designed to facilitate financial fraud, siphon session tokens, and exfiltrate sensitive user data from targeted banking profiles.

Historical Context and Campaign Evolution

Threat intelligence assessments indicate that the actors behind the KREMLIN operation have maintained an active presence in the cybercrime landscape since mid-2025. Historical tracking reveals a progressive shift in tactics. Between June 2025 and mid-2026, the REF9334 cluster engaged in at least seven distinct campaigns involving the distribution of off-the-shelf remote access trojans (RATs) such as Pulsar RAT and the fileless variant of Remcos RAT, alongside preliminary trials of malicious browser extensions.

The pivotal transition to utilizing Ethereum smart contracts occurred on May 19, 2026, marking a significant maturation in the group’s operational security and infrastructure resilience. This evolution highlights a broader trend among financially motivated cybercriminal syndicates: the adoption of decentralized ledger technologies to decentralize command-and-control networks, bypassing traditional law enforcement takedowns and sinkholing efforts.

Implications and Defensive Recommendations

The emergence of the KREMLIN malware ecosystem underscores a growing security challenge regarding the integrity of modern web browsers. As enterprises and financial institutions increasingly rely on web-based applications and cloud services, browser extensions have become prime targets for cybercriminals seeking to bypass multi-factor authentication (MFA) and session timeouts. By capturing authentication tokens directly from active browser profiles, malware like KREMLIN can effectively neutralize standard security controls implemented by online banking platforms.

Cybersecurity analysts emphasize that mitigating threats of this nature requires a multi-layered defense strategy. Organizations and individual users are advised to maintain strict endpoint detection and response (EDR) solutions capable of monitoring anomalous file modifications, such as unauthorized tampering with browser preference files. Furthermore, continuous monitoring of network traffic for unusual outbound connections—particularly those attempting to resolve infrastructure via blockchain smart contracts or interacting with known canary domains—remains essential for early detection.

As financial malware operations continue to innovate through decentralized technologies and advanced evasion techniques, security researchers stress the importance of international collaboration and real-time threat intelligence sharing to disrupt evolving campaigns before widespread financial damage can occur.