Malware
KREMLIN
- First Reported
- Sep 15, 2026
- Latest Reported
- Sep 16, 2026
Reported Context (3)
- A banking malware campaign active since mid-2025 has used the KREMLIN toolkit to silently install malicious Chrome and Edge extensions that steal credentials, session tokens, and browser data. KREMLIN Malware Bypasses Chrome and Edge Checks to Install Data-Stealing Extensions
- Researchers uncovered KREMLIN, a previously undocumented Brazilian banking malware operation tracked as REF9334 that uses fake bank lures, malicious browser extensions, and multi-stage loaders to steal credentials and KREMLIN Banking Malware Uses Ethereum Contracts to Steal Browser Data
- Elastic Security Labs tracked REF9334, a Brazilian banking malware operation using the KREMLIN toolkit to deliver malicious browser extensions, credential theft, and staged loaders through JavaScript, Node.js, RunPE, KREMLIN Malware Forges Chromium Integrity Checks to Install Banking-Theft Extensions
Malware (3)
People (2)
Threat Actors (2)
MITRE ATT&CK (17)
Vendors (1)
Products (4)
Tools (2)
Industries (1)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.