Cybersecurity researchers at **Elastic Security Labs** have brought to light a previously undocumented Brazilian banking malware operation, which they are tracking under the moniker **REF9334**. This threat actor, active since at least May 2025, has been observed deploying a sophisticated toolkit known as **KREMLIN**. The operation primarily targets users of **Google Chrome** and **Microsoft Edge**, luring victims with impersonations of a dozen prominent Brazilian banks to install malicious browser extensions. ### Multi-Stage Attack Chain and Evasive Techniques "The **KREMLIN** malware ecosystem employs multi-stage JavaScript loaders, custom C++ installers, and malicious browser extensions to steal credentials, session tokens, and sensitive data," explained security researchers Cyril François and Andrew Pease in their technical report. They further noted, "Malicious browser extensions bypass Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs, and App-Bound encrypted hashes." A particularly innovative aspect of **KREMLIN** is its use of blockchain technology to obscure its infrastructure. The attackers leverage **Ethereum** smart contracts as 'dead drop resolvers' to dynamically update their command-and-control (C2) endpoints and payload hosting locations, making disruption significantly more challenging. ### Infection Vector and Payload Delivery The initial compromise typically begins with a JavaScript file, disguised as a banking, invoice, or company document, which the victim manually executes. This triggers a multi-stage loader designed with anti-sandbox and anti-virtual machine checks. If these checks pass, the loader proceeds to download and install additional payloads.  The second stage of the attack chain is responsible for establishing persistence via a scheduled task, retrieving download locations from an **Ethereum** smart contract (e.g., `0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b`), and then downloading and executing the third-stage payloads. These payloads include: * A malicious browser extension installer. * A .NET PE Injector. * A legitimate binary, `SentinelMemoryScanner.exe`, associated with **SentinelOne**, which is abused for DLL sideloading. ### Abusing Legitimate Software for Evasion The C++ installer leverages the legitimate **SentinelOne** binary to sideload its unsigned main payload, which masquerades as `SentinelAgentCore.dll`. This DLL performs further sandbox and virtual machine evasion checks, scrutinizing running processes and system hardware properties like CPU count and RAM capacity. If the system exhibits characteristics indicative of a sandbox (e.g., specific process names, less than 2 CPUs, or under 3 GB RAM), the malware terminates. **KREMLIN** also queries the same **Ethereum** smart contract to fetch domains like `volmira[.]site` and `zaviro[.]online`, using the former to retrieve the browser extension's version ("1.0.0") and ID ("ndpbidppejfanjbhfgjlohfanbfbklff"). The extension is named "AVSync System Inc." "Before downloading the archive, the malware checks whether the extension is already installed and, if so, compares the installed version with the version reported by the server," the researchers noted. "It downloads the extension only when no local installation is found, or the versions differ. It then downloads the Chrome extension as a ZIP archive." ### Browser Extension Installation and Data Exfiltration  To install the extension on **Chromium-based browsers**, **KREMLIN** employs publicly documented integrity bypass techniques such as **Phantom Extension** and **GhostChrome-X**. This involves modifying the Secure Preferences file, enabling Chrome's developer mode, and updating the `protection.macs` JSON object with forged metadata to register the malicious extension without triggering built-in protections. This approach mirrors tactics previously observed, including a late August 2026 campaign by the China-linked **APT31** actor, which utilized the **BlueMoon** exploit kit to deploy the credential-stealing **GemStone** browser extension. Once installed, the **KREMLIN** extension demands extensive permissions, including access to browser tabs, cookies, storage, and the **webRequest API**. It then begins harvesting and exfiltrating browser data from each profile to its C2 server (`luizestrelhashapr[.]online:443`). A unique victim identifier is generated and stored in the browser's local storage, included in all C2 communications. ### C2 Communication and Capabilities The extension establishes a **WebSocket** channel with the C2 server, supporting a range of commands: * Taking and uploading compressed screenshots of selected or active tabs. * Enumerating and uploading lists of tabs, domains, and active states. * Stealing cookies, `sessionStorage`, and `localStorage`. * Collecting up to 1,000 history entries from the previous 15 days (though this may fail due to manifest permission limitations). * Extracting and uploading full HTML source of selected or active pages. * Downloading attacker-controlled HTML. * Refreshing configuration. In addition to **WebSocket**, the extension periodically polls a `/google_api/` endpoint via requests disguised as CSS file fetches. Each path corresponds to a specific command, such as `108766d0.css` for uploading cookies, or `0f51ad2f.css` for uploading compressed JPEG screenshots. ### Campaign History and Mitigation Efforts The actors behind **KREMLIN** are believed to have been active since at least May 2025, previously distributing off-the-shelf Trojans like **Pulsar RAT** and **Remcos RAT**. The transition to **Ethereum** smart contracts for C2 is estimated to have occurred on May 19, 2026. In total, **Elastic Security Labs** attributes seven distinct campaigns to the group since June 16, 2025. As part of its anti-sandbox mechanisms, the malware performs a network canary check by attempting to download a page from an unregistered domain. A valid response indicates a simulated network environment, leading the malware to deliberately crash. **Elastic** successfully registered this network canary domain and identified 1,515 infected systems attempting to connect, with over 98% geolocated in Brazil. "While these systems are still infected with the final component of **KREMLIN**, this has temporarily degraded and manipulated the campaign's defense mechanisms and could provide defenders with additional time to identify and remediate infected endpoints," **Elastic** stated, highlighting a critical window for remediation.