KREMLIN Malware Hijacks Browsers to Steal Bank Data

Introduction

In recent months, a previously unseen wave of banking malware has targeted users across Brazil, leveraging familiar web browsers to exfiltrate sensitive financial information. Security teams at Elastic have labeled this campaign REF9334 and given the malicious toolkit the name KREMLIN. The operation, which appears to have begun in May 2025, relies on convincing phishing pages that imitate the login portals of numerous Brazilian financial institutions. By delivering a crafted Chrome or Edge extension, the attackers gain persistent access to victims’ browsing sessions, allowing them to capture login cookies, saved passwords, and active authentication tokens. This stealthy approach enables credential theft without the need for traditional keyloggers, making detection more challenging for conventional security solutions.

Undocumented Brazilian Banking Threat Emerges

The KREMLIN malware family, uncovered by Elastic Security Labs, represents a sophisticated, multi‑stage attack chain designed specifically for financial credential harvesting. Operating under the REF9334 identifier, the actors behind the campaign have refined their social engineering tactics to mimic the websites and mobile applications of at least a dozen Brazilian banks. Their primary delivery vector is a malicious browser extension that masquerades as a legitimate add‑on, often distributed through compromised ad networks or malvertising. Once installed, the extension runs silently in the background, injecting scripts into the browser’s rendering engine to intercept HTTP requests and extract authentication data. The campaign’s longevity—spanning many months—suggests a well‑funded operation with a clear monetization goal: stealing banking credentials and session tokens to facilitate unauthorized transfers or sell the data on underground markets.

Browser Extension Weaponization: Chrome and Edge Compromise

What sets KREMLIN apart is its reliance on browser extensions as the primary infection vector. The malicious add‑on is signed with a forged certificate, giving it a veneer of legitimacy that bypasses many browser security checks. Key capabilities include:

• Injection of JavaScript into every visited page, enabling real‑time capture of form submissions.
• Extraction of stored cookies and session tokens from the browser’s storage, allowing attackers to reuse active login sessions.
• Harvesting of saved passwords and autofill data, providing additional credentials for future attacks.
• Stealthy operation that avoids obvious indicators such as new processes or network traffic spikes.

Because Chrome and Edge dominate the desktop market, the reach of this extension is extensive, exposing millions of potential victims. The extension also communicates with command‑and‑control servers using encrypted channels, making interception difficult without deep packet inspection.

Impact on Financial Institutions and Users

The ramifications of this campaign are profound. Financial institutions face reputational damage and potential regulatory penalties when customer data is compromised. Victims may experience unauthorized withdrawals, identity theft, and long‑term credit damage. Moreover, the stealthy nature of the extension makes it hard for end‑users to detect compromise, increasing the likelihood of prolonged exposure. From a broader perspective, the proliferation of browser‑based malware underscores the need for layered defenses that include endpoint detection, regular extension audits, and user education on suspicious add‑ons.

Conclusion

In summary, the KREMLIN banking malware demonstrates how sophisticated social engineering combined with client‑side browser hijacking can bypass traditional security controls and deliver devastating financial theft. As the threat landscape continues to evolve, organizations must prioritize proactive monitoring, robust endpoint protections, and continuous education to stay ahead of emerging attacks. Grivyonx Cloud remains committed to delivering AI‑driven security solutions that help safeguard both data and user confidence in an increasingly complex digital world.