KREMLIN Banking Malware Uses Ethereum Contracts to Steal Browser Data
Summary
Elastic detailed KREMLIN, a Brazilian banking malware operation that uses malicious Chrome and Edge extensions to steal credentials and session data. Elastic observed 1,515 infected systems checking a network canary, more than 98% in Brazil.
Key points
- Elastic tracks the operation as REF9334 and says it has been active since at least May 2025, using fake bank, invoice, and company-document lures.
- A multi-stage chain uses JavaScript loaders and a C++ installer to deliver payloads, establish persistence, and evade sandboxes and virtual machines.
- The malware uses Ethereum smart contracts to retrieve command-and-control and payload locations.
- A malicious Chrome and Edge extension bypasses Chromium integrity protections and can steal cookies, session storage, local storage, tab information, and page content.
- The extension can also capture screenshots, enumerate tabs, and receive commands over a WebSocket connection.
- Elastic observed 1,515 infected systems checking its registered network canary domain; more than 98% were geolocated to Brazil.
- Elastic said registering the canary domain temporarily disrupted the malware’s anti-sandbox checks, potentially giving defenders time to identify and remediate infected endpoints.
Article Details
- Attack Vectors
- Victims manually execute JavaScript files disguised as banking, invoice, or company documents.
- Multi-stage loaders retrieve payload locations from Ethereum smart contracts, download binaries, and execute subsequent stages.
- A custom C++ installer uses DLL side-loading to launch an unsigned payload impersonating SentinelAgentCore.dll.
- Malicious extensions are installed on Chrome and Edge by modifying Secure Preferences and forging HMAC metadata.
- The extension harvests browser cookies, session and local storage, tabs, browsing history, screenshots, and page HTML, then sends data to its C2 over WebSocket and HTTP requests.
- Defensive Notes
- Elastic registered the malware's network-canary domain and observed 1,515 infected systems attempting to check in; the researchers said this temporarily degraded the campaign's defenses and could give defenders time to identify and remediate infected endpoints.
- Review Chrome and Edge Secure Preferences for unauthorized extension registrations or forged protection.macs metadata, and investigate the extension name AVSync System Inc. and ID ndpbidppejfanjbhfgjlohfanbfbklff.
- Investigate scheduled tasks, unexpected SentinelMemoryScanner.exe execution, and unsigned DLLs masquerading as SentinelAgentCore.dll.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | volmira[.]site | Domain retrieved by KREMLIN from its Ethereum smart contract and queried for browser-extension version and ID information. |
| DOMAIN | zaviro[.]online | Domain retrieved by KREMLIN from its Ethereum smart contract as part of its infrastructure. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe extension uploads harvested browser data, including cookies, storage, screenshots, and page HTML, to its C2.T1053.005 · Scheduled TaskThe second-stage loader establishes persistence via a scheduled task.T1059.007 · JavaScriptThe infection starts with a JavaScript file that the victim manually executes; JavaScript loaders also advance the infection.T1071.001 · Web ProtocolsThe extension communicates with its C2 over WebSocket and periodically polls HTTP endpoints disguised as CSS fetches.T1105 · Ingress Tool TransferThe loaders download additional binaries and payloads from locations retrieved through an Ethereum smart contract.T1113 · Screen CaptureThe extension captures screenshots of the selected or active browser tab and uploads them.T1176 · Software ExtensionsKREMLIN installs a malicious extension on Chrome and Edge to collect browser data.T1204.002 · Malicious FileVictims manually execute JavaScript files disguised as banking, invoice, or company documents.T1497.001 · System ChecksThe JavaScript loader and sideloaded DLL check for sandbox or virtual-machine indicators, including processes and hardware properties, and stop execution when checks indicate an analysis environment.T1539 · Steal Web Session CookieThe extension steals browser cookies and session data from the selected or active tab.T1574.002 · DLL Side-LoadingThe C++ installer abuses SentinelMemoryScanner.exe to sideload an unsigned payload impersonating SentinelAgentCore.dll.
People
Malware
KREMLINResearchers uncovered KREMLIN, a previously undocumented Brazilian banking malware operation tracked as REF9334 that uses fake bank lures, malicious browser extensions, and multi-stage loaders to steal credentials andPulsar RATIt’s assessed that the actors behind KREMLIN have been active since at least May 2025, including installing malicious browser extensions and distributing off-the-shelf Trojans like Pulsar RAT and Remcos RAT.Remcos RATIt’s assessed that the actors behind KREMLIN have been active since at least May 2025, including installing malicious browser extensions and distributing off-the-shelf Trojans like Pulsar RAT and Remcos RAT.