KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials

What is the KREMLIN Banking Malware?

KREMLIN is a sophisticated banking trojan that first appeared in public reports in mid 2025. The malware is built around a modular toolkit that can deliver a range of payloads, but its most notable feature is a malicious browser extension designed for Google Chrome and Microsoft Edge. Security analysts at Elastic Security Labs have been tracking the campaign under the internal name REF9334.

Discovery and naming

The first samples were captured by Brazilian CERT.br when users reported unexpected extensions appearing after clicking on phishing emails that pretended to be from local banks. The researchers named the toolkit KREMLIN because the code contains references to Russian‑style naming conventions, even though the infrastructure points to Brazil.

How KREMLIN hijacks Chrome and Edge

The infection chain begins with a lure that mimics the branding of more than a dozen Brazilian financial institutions. Victims receive a short message that claims an urgent security update or a new feature. The link leads to a compromised website that hosts a drive‑by download or a malicious installer.

Malicious extension deployment

Once the initial payload runs, it silently installs a browser extension using the standard extension APIs. The extension requests permissions that include read and change all data on websites you visit, as well as access to cookies and local storage. Because the extension is signed with a valid certificate, browsers often accept it without prompting the user.

Credential and session token theft

After installation, the extension monitors traffic to banking domains. When a user logs in, the extension captures the username, password, and any one‑time passwords entered. It also extracts session cookies and authentication tokens, which allow the attacker to hijack active sessions without needing the original credentials again. The stolen data is bundled and sent to a command‑and‑control server using encrypted HTTPS requests.

Indicators of compromise

Analysts have identified several tell‑tale signs that a system may be infected:

• Unexpected browser extensions with generic names such as "Secure Login" or "Bank Helper".
• Network traffic to suspicious domains that resolve to IP addresses located in Brazil or Eastern Europe.
• New scheduled tasks or services that launch the initial loader.
• Presence of files with random names in the user’s AppData folder.

Security teams can use these indicators to create detection rules in SIEM platforms. The CISA alert provides a detailed YARA rule set for the extension files.

Mitigation and protection steps

Both individuals and organizations can take concrete actions to reduce the risk of infection:

1. Review installed extensions regularly and remove any that are unfamiliar.
2. Enable two‑factor authentication on all banking accounts and prefer hardware tokens over SMS codes.
3. Apply the latest security patches for Chrome and Edge; both browsers now include stricter extension verification mechanisms.
4. Deploy web‑filtering solutions that block known malicious URLs and file types.
5. Educate users about phishing tactics that mimic bank communications.

For enterprises, configuring browser policies to allow extensions only from trusted stores can stop the silent installation. The Chrome Web Store policies and the Edge extension security guide offer guidance on enforcing such controls.

Impact on the Brazilian banking sector

Since its emergence, KREMLIN has been linked to thousands of compromised accounts across Brazil’s major banks. The financial loss is difficult to quantify because many victims do not report the theft, fearing reputational damage. However, banks have reported an increase in fraudulent transfers that bypass traditional fraud detection models, as attackers use valid session tokens to move money instantly.

Regulators have responded by issuing advisories that require banks to monitor for anomalous session activity and to implement real‑time token revocation. The Brazilian Central Bank’s official guidelines now include recommendations for multi‑layered authentication that can mitigate the effectiveness of stolen tokens.

Future outlook and researcher recommendations

Security researchers expect the KREMLIN operators to evolve the toolkit, possibly adding support for additional browsers such as Firefox or Safari. Continuous monitoring of extension marketplaces and rapid sharing of IOCs will be essential. Collaboration between private security firms, banks, and government agencies can accelerate the development of detection signatures.

In the meantime, users should treat any unexpected browser extension with suspicion, verify the source before installing, and keep their browsers up to date. By combining technical controls with user awareness, the threat posed by KREMLIN can be substantially reduced.