KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
A previously undocumented Brazilian banking malware operation, dubbed KREMLIN, has been identified by Elastic Security Labs. The threat actor, active since May 2025, utilizes a multi-stage approach involving JavaScript loaders, C++ installers, and malicious browser extensions to steal credentials and session tokens. A key element is the use of Ethereum smart contracts to dynamically update command-and-control (C2) endpoints and host payloads, alongside sophisticated techniques like Phantom Extension and GhostChrome-X to bypass browser security measures. The majority of infected systems are located in Brazil.
Elastic Security Labs has shed light on a previously undocumented Brazilian banking malware operation, dubbed KREMLIN. The threat actor, active since at least May 2025, employs a multi-stage approach to compromise victims, utilizing JavaScript loaders, C++ installers, and malicious browser extensions to steal credentials, session tokens, and sensitive data. A defining characteristic of the operation is the integration of blockchain technology, specifically Ethereum smart contracts, to dynamically update command-and-control (C2) endpoints and payload hosting locations, making disruption more difficult.
To achieve this, KREMLIN begins with a JavaScript file masquerading as a banking, invoice, or company document, which leads to the execution of a multi-stage loader. The loader performs four tasks: establishing persistence via a scheduled task, retrieving C2 locations from an Ethereum smart contract, downloading necessary binaries, and executing the third stage. The malware leverages a legitimate binary, "SentinelMemoryScanner.exe," associated with SentinelOne, to sideload its unsigned main payload, impersonating "SentinelAgentCore.dll." This DLL employs sophisticated anti-sandbox techniques, scanning running processes and checking machine hardware properties (CPU count and RAM) to evade detection.
If the system lacks the required hardware specifications or if any running process matches a name in its hardcoded list, the malware terminates its execution. KREMLIN also reaches out to the same Ethereum smart contract to fetch two domains – volmira[.]site and zaviro[.]online – and queries the former to obtain the browser extension version ("1.0.0") and ID ("ndpbidppejfanjbhfgjlohfanbfbklff"). The extension goes by the name "AVSync System Inc."
Before downloading the archive, the malware checks whether the extension is already installed and, if so, compares the installed version with the version reported by the server. It downloads the extension only when no local installation is found, or the versions differ. The extension is then downloaded as a ZIP archive. To install the extension on Chromium-based browsers, it utilizes a publicly documented integrity bypass technique called Phantom Extension and GhostChrome-X, bypassing the Secure Preferences protection mechanism. This involves modifying the Secure Preferences file, enabling Chrome's developer mode, and updating the "protection.macs" JSON object with forged metadata to register the malicious Chrome extension.
The actors behind KREMLIN have been active since at least May 2025, including installing malicious browser extensions and distributing off-the-shelf Trojans like Pulsar RAT and Remcos RAT. The transition to Ethereum smart contracts occurred on May 19, 2026. In all, the group has been attributed to seven distinct campaigns since June 16, 2025. As part of its anti-sandbox mechanism, the malware performs a network canary check by attempting to download a page from an unregistered domain. If it receives a valid response, it likely indicates a sandbox that's simulating network connectivity, and the malware deliberately crashes.
Elastic Security Labs registered the network canary domain and identified 1,515 infected systems attempting to check into the network canary domain. More than 98% of the systems are geolocated to Brazil. "So while these systems are still infected with the final component of KREMLIN, this has temporarily degraded and manipulated the campaign's defense mechanisms and could provide defenders with additional time to identify and remediate infected endpoints," Elastic said.