They Didn’t Rob the Bank. They Robbed the Browser: Inside the KREMLIN Banking Malware Operation
Bank robbers used to target the vault.
KREMLIN takes a different approach. Instead of breaking into the bank itself, the attackers work their way onto the victim’s computer, hide an accomplice inside Chrome or Edge and wait for valuable information to pass directly in front of them.
Credentials. Cookies. Session tokens. Screenshots. Entire web pages.
The Brazilian banking malware operation, tracked by Elastic Security Labs as REF9334, has been active since at least May 2025 and has impersonated a dozen Brazilian banks. Its defining weapon is a malicious browser extension capable of turning the victim’s own browser into the perfect lookout.
Here is how the robbery unfolds, phase by phase.
Phase 1 — Dress Up as Something Legitimate
Every successful robbery needs a way through the front door.
KREMLIN begins with a JavaScript file disguised as a banking, invoice or company document. The victim must manually execute it, triggering a multi-stage infection chain.
Before proceeding, however, the malware checks its surroundings.
It searches for signs of sandboxes and virtual machines, examining running processes and hardware characteristics. If the environment looks like a security analysis system rather than a real victim machine, the operation stops.
The thieves first make sure no one is watching.
Phase 2 — Establish the Hideout
Once the environment passes inspection, the second stage establishes persistence through a scheduled task.
But KREMLIN does not simply rely on conventional attacker-controlled infrastructure to determine where its next tools are located.
Instead, it queries an Ethereum smart contract.
The blockchain acts as a dead drop resolver, allowing the operators to dynamically retrieve locations for command-and-control infrastructure and payload hosting.
Rather than leaving the address of the hideout somewhere defenders can easily remove it, the thieves use the blockchain to tell their accomplices where to meet next.
Phase 3 — Smuggle the Accomplice Inside
The next objective is to install the component that will actually watch the victim: a malicious Chromium browser extension called “AVSync System Inc.”
KREMLIN uses a C++ installer and abuses a legitimate SentinelOne binary for DLL sideloading, launching an unsigned payload masquerading as SentinelAgentCore.dll.
To install the extension, the malware uses techniques associated with Phantom Extension and GhostChrome-X to bypass Chromium integrity protections.
It modifies Secure Preferences, enables developer mode and forges the metadata required to register the malicious extension.
The thieves have now moved past the entrance.
They have placed an accomplice inside the browser itself.
Phase 4 — Watch the Victim Open the Vault
Once installed in Chrome or Edge, the extension requests extensive access to tabs, cookies, storage and the webRequest API.
That gives KREMLIN visibility into the environment where users authenticate to websites and interact with sensitive services.
The extension can steal cookies, sessionStorage and localStorage, enumerate open tabs and domains, capture screenshots, extract the complete HTML source of active pages and intercept requests.
This changes the nature of the robbery.
The attackers are no longer simply trying to steal a password before the victim reaches the bank.
They can watch what happens after the victim has already authenticated.
Phase 5 — Steal the Keys, Not Just the Combination
Credentials are valuable.
Authenticated sessions can be even more useful.
By collecting cookies and browser storage, KREMLIN targets information associated with active sessions alongside conventional sensitive data.
The extension communicates with its command-and-control infrastructure through WebSockets and can receive commands to capture screenshots, enumerate tabs, steal browser storage, extract page HTML and download attacker-controlled content.
It also periodically communicates with endpoints disguised as ordinary CSS file requests, with different paths corresponding to different commands and stolen information.
To anyone looking casually at the traffic, the getaway can appear far less suspicious than it really is.
Phase 6 — Keep Moving the Hideout
Infrastructure is a vulnerability for cybercriminals.
Domains can be blocked. Servers can be taken down. Indicators can be distributed to defenders.
KREMLIN attempts to make that disruption more difficult by using Ethereum smart contracts to dynamically identify infrastructure and payload locations.
Researchers assessed that the operators transitioned to this blockchain-based approach on May 19, 2026.
The technique gives the campaign another layer of resilience: defenders cannot necessarily dismantle the operation simply by removing one hard-coded command-and-control address.
The thieves can change hideouts without rewriting the entire plan.
Phase 7 — Detect the Robbery
KREMLIN’s layered approach means defense needs to extend beyond looking for a single malicious file.
Organizations should monitor suspicious JavaScript execution, scheduled-task persistence, DLL sideloading and unexpected changes to Chromium Secure Preferences. Chrome and Edge environments should also be audited for unauthorized extensions and unexpected activation of developer mode.
If compromise is suspected, removing the malicious extension alone may not be sufficient. Potentially exposed credentials and authenticated sessions should also be revoked because the malware specifically targets cookies and browser storage.
Network monitoring can provide another layer of visibility, including activity associated with the campaign’s infrastructure and its use of Ethereum smart contracts to resolve attacker-controlled resources.
Elastic also identified an unusual weakness in KREMLIN’s anti-analysis defenses. The malware contacted an unregistered domain as a network canary: receiving a valid response could indicate that it was running inside a sandbox simulating connectivity, causing the malware to deliberately crash.
After registering that domain, Elastic observed 1,515 infected systems attempting to contact it, with more than 98% geolocated in Brazil.
For defenders, that provided an unexpected glimpse inside the thieves’ operation.
The Vault Has Moved
KREMLIN illustrates why modern banking malware does not necessarily need to attack banking infrastructure directly.
The browser has become an extraordinarily valuable target because it sits between the user and almost every service they trust.
It knows which pages are open. It stores cookies and session information. It renders authenticated content. It handles requests. And, with enough permissions, a malicious extension can observe much of that activity from inside.
The bank may have excellent locks.
The vault may be heavily protected.
The customer may even authenticate successfully.
But none of that solves the problem if the robber is already standing beside them when they open the vault.
The Hacker News
Comentarios