KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

The malware toolkit, named KREMLIN, is associated with an operation tracked by Elastic Security Labs as REF9334. The campaign has been active since at least May 2025 and primarily targets users in Brazil with lures impersonating banks, invoices and business documents.

Researchers identified 1,515 infected systems, with more than 98% located in Brazil. The threat actors have also impersonated approximately a dozen Brazilian financial institutions as part of their social-engineering campaigns.

Attack Starts With a Fake Document

The infection begins when a victim receives a malicious JavaScript file disguised as a legitimate banking document, invoice or corporate file.

Unlike a zero-click attack, the victim must manually execute the malicious file.

Once launched, KREMLIN begins a multi-stage infection process and checks whether it is running inside a virtual machine or security-analysis sandbox. If the environment appears suspicious, the malware can terminate rather than expose its capabilities to researchers.

A simplified attack chain looks like:

Malicious banking or invoice document
↓
Victim executes JavaScript file
↓
Sandbox and VM checks
↓
Scheduled task created for persistence
↓
Ethereum smart contract queried
↓
Additional malware components downloaded
↓
DLL sideloading executed
↓
Malicious Chrome/Edge extension installed
↓
Browser credentials, cookies and sessions stolen

Ethereum Blockchain Used to Hide Attack Infrastructure

One of KREMLIN's most unusual techniques is its use of Ethereum smart contracts as a mechanism for discovering attacker-controlled infrastructure.

Rather than hardcoding permanent command-and-control and payload-hosting addresses into the malware, the operators can store information through blockchain-based smart contracts.

KREMLIN retrieves updated infrastructure information from these contracts before downloading additional components. Elastic says the campaign transitioned to using Ethereum smart contracts on May 19, 2026.

This provides attackers with additional infrastructure resilience because malicious domains and servers can be changed without rebuilding and redistributing the initial malware.

Legitimate SentinelOne Binary Abused for DLL Sideloading

The infection chain also abuses a legitimate executable associated with SentinelOne called:

SentinelMemoryScanner.exe

KREMLIN uses the legitimate program to perform DLL sideloading, causing it to load an attacker-controlled DLL masquerading as:

SentinelAgentCore.dll

The malicious DLL performs additional anti-analysis checks, including examining running processes and system hardware characteristics such as available RAM and CPU count.

This technique allows attackers to execute malicious code through a trusted legitimate executable and can make detection more difficult when security controls rely heavily on process reputation.

Malicious Extension Poses as Security Software

KREMLIN's primary objective is to install a malicious browser extension into Chrome and Edge.

The extension has been observed using the name:

AVSync System Inc.

Rather than asking the victim to install the extension through the Chrome Web Store, KREMLIN modifies Chromium browser configuration files directly.

The malware manipulates the browser's Secure Preferences, enables developer mode and recreates integrity information required by Chromium.

This technique allows the malicious extension to become registered without following the normal extension-installation workflow.

The approach is based on publicly documented techniques known as Phantom Extension and GhostChrome-X.

What KREMLIN Can Steal

Once installed, the extension requests extensive access to browser functionality, including tabs, cookies, storage and web requests.

Researchers found that it can collect:

• Browser cookies
• Session tokens
• sessionStorage data
• localStorage data
• Open browser tabs
• Active websites
• Screenshots
• Full HTML content from webpages
• Web request information
• Browser activity
• Potentially sensitive banking information

The extension can also receive commands from its command-and-control infrastructure over a WebSocket connection.

This effectively turns the browser into a surveillance point for the attacker.

Session Tokens Create Account-Takeover Risk

One of the most important capabilities is KREMLIN's ability to steal authenticated browser-session information.

Traditional credential-stealing attacks focus primarily on obtaining usernames and passwords.

KREMLIN can go further by collecting cookies and session information from users who have already authenticated.

Conceptually:

Victim logs into bank
↓
Bank authenticates user
↓
Browser receives authenticated session
↓
KREMLIN extension accesses session data
↓
Session information sent to attacker

Depending on how the targeted service validates sessions, stolen authenticated session material can potentially help attackers impersonate victims without simply replaying the original password.

This is why browser-session theft has become increasingly important for defenders: strong passwords and MFA remain valuable, but security monitoring must also account for post-authentication session abuse.

Malware Can Capture Entire Banking Pages

KREMLIN does not restrict itself to credentials.

Researchers found commands capable of taking a screenshot of an active browser tab and extracting the complete HTML source of the page being viewed.

This could expose information displayed after authentication, including account details, transaction information and other sensitive content.

The extension can also download attacker-controlled HTML, providing opportunities to manipulate what users see inside their browsing environment.

C2 Requests Disguised as CSS Files

KREMLIN also attempts to make command-and-control traffic look less suspicious.

The extension periodically contacts a /google_api/ endpoint using requests that appear to retrieve ordinary CSS files.

Different CSS-style filenames correspond to different malware commands, including operations for collecting cookies, enumerating tabs, capturing screenshots and retrieving targeting configurations.

This demonstrates why defenders cannot rely solely on file extensions when determining the true purpose of network requests.

More Than 1,500 Infected Systems Identified

Elastic Security Labs gained additional visibility into the campaign after registering a previously unused domain that KREMLIN used as a network canary.

Researchers subsequently observed 1,515 infected systems attempting to contact the domain.

More than 98% were geolocated in Brazil, reinforcing the assessment that KREMLIN is primarily focused on Brazilian targets.

The campaign has evolved across seven identified operations, and earlier activity was also associated with distribution of remote-access malware including Pulsar RAT and Remcos RAT.

KREMLIN Is Not Linked to Russia

Despite its name, researchers have found no evidence connecting KREMLIN to the Russian government or Russian threat actors.

The name originates from the malware ecosystem rather than geographic attribution.

Available evidence instead points strongly toward Brazil: the campaigns use Portuguese-language material, impersonate Brazilian banks, and the overwhelming majority of identified infections are located in the country.

This distinction is important because the malware's name could otherwise create a misleading geopolitical association.

What Security Teams Should Look For

Organizations should monitor for unusual modifications to Chrome and Edge configuration files, particularly changes involving Secure Preferences.

Other useful detection opportunities include suspicious:

• Browser extensions installed outside approved enterprise mechanisms
• Changes enabling Chrome or Edge developer mode
• Modifications to Secure Preferences integrity values
• Scheduled tasks created by unknown JavaScript loaders
• Execution of SentinelMemoryScanner.exe from unexpected locations
• SentinelAgentCore.dll appearing outside legitimate SentinelOne installations
• DLL sideloading behavior
• Browser processes communicating with unusual WebSocket endpoints
• JavaScript files launched from Downloads or temporary directories
• Browser extensions requesting extensive cookie, storage and web-request permissions
• Unexpected connections involving Ethereum infrastructure

Security teams should also investigate extensions identifying themselves as AVSync System Inc. when they have not been approved by the organization.

How Users Can Reduce the Risk

Users should avoid executing unexpected JavaScript files received as invoices, banking documents or corporate records.

Organizations can further reduce exposure by centrally controlling which Chrome and Edge extensions are permitted.

Recommended measures include:

• Implement browser-extension allowlisting.
• Block unauthorized developer-mode extensions.
• Monitor browser configuration changes.
• Use EDR to detect suspicious DLL sideloading.
• Monitor scheduled-task creation.
• Keep browsers and endpoint-security software updated.
• Train employees to recognize malicious document lures.
• Investigate unusual browser-session activity.
• Revoke active sessions when credential or cookie theft is suspected.
• Reset affected credentials after containing an infected endpoint.

If KREMLIN is discovered on a system, changing the password alone may not be sufficient. Existing authenticated sessions should also be invalidated because session information may already have been exposed.

Security Takeaway

KREMLIN demonstrates how modern banking malware is increasingly shifting its attention from the operating system directly into the web browser and authenticated user session.

By forcing a malicious extension into Chrome and Edge, the attackers gain visibility into websites after users have logged in. That can expose credentials, cookies, session storage, screenshots and entire webpages.

The operation also combines several techniques designed to increase resilience and evade detection: multi-stage JavaScript loaders, sandbox detection, scheduled-task persistence, DLL sideloading, Chromium integrity bypasses and Ethereum-based infrastructure discovery.

For defenders, the campaign reinforces an important security lesson: the browser has become a critical endpoint security boundary.

Protecting passwords and deploying MFA remain essential, but organizations must also monitor browser extensions, session tokens, browser configuration and post-authentication activity to detect attacks that occur after a user has successfully logged in.

SEO Meta Description:
KREMLIN banking malware hijacks Chrome and Edge with malicious extensions to steal credentials, cookies and session tokens while using Ethereum smart contracts to hide its attack infrastructure.