Researchers from Elastic Security Labs have detailed the operation of a banking malware named KREMLIN, tracked under the identifier REF9334, that hijacks Chrome and Edge browsers to steal credentials and session tokens. The campaign targets Brazil almost exclusively.
Of the 1,515 infected systems identified, 98 percent are located in the country. The malware impersonates approximately ten different Brazilian banks. Infection starts with multi-stage JavaScript loaders disguised as banking documents, invoices, or corporate papers. Victims must execute the file manually, after which C++ installers and malicious browser extensions are downloaded.
To install the extension without triggering browser protections, the malware alters the Secure Preferences file, enables developer mode, and rewrites protection objects with forged metadata. Researchers refer to this method as Phantom Extension.
Once the extension is active, theft extends beyond passwords. The malware collects session tokens, cookies, data from sessionStorage and localStorage, browsing history from the previous 15 days, screenshots, information on open tabs, and the complete HTML of visited pages.
The operation has been active since May 2025 and includes seven distinct campaigns since June of that year. On 19 May 2026 the operators began using smart contracts on the Ethereum network as part of their infrastructure.
Recommendations include monitoring for unauthorized extension installations in corporate browsers and tracking changes to Chrome and Edge integrity files, as metadata replacement is central to the Phantom Extension technique.
