KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and Microsoft Edge.

The malicious extensions are designed to hijack browser sessions, allowing the attackers to steal credentials and session tokens from victims. This technique enables the threat actor to bypass multi-factor authentication and gain unauthorized access to banking accounts, potentially leading to financial fraud.

The operation appears to be focused on Brazilian bank customers, with phishing lures crafted to appear as legitimate banking communications. The exact distribution methods beyond the described lures have not been fully disclosed, and the full extent of compromised victims remains unverified.

Elastic Security Labs has provided detection guidance for organizations and individuals to identify and mitigate the threat. Users are advised to remove any suspicious browser extensions, especially those impersonating banking applications, and to keep browsers and operating systems updated. Reputable security software should also be used to detect and block such threats.

While the threat actor's identity and infrastructure details may require further verification, the reported activity highlights the ongoing evolution of banking malware and the importance of browser security. Organizations and individuals in Brazil, and potentially elsewhere, should remain vigilant against phishing attempts and unauthorized browser extensions.