KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
-
Cybersecurity researchers at Elastic Security Labs have detailed a previously undocumented Brazilian banking malware operation tracked as REF9334. Active since at least May 2025, the campaign delivers a toolkit named KREMLIN and relies on lures that impersonate roughly a dozen Brazilian banks to trick victims into installing a malicious browser extension on Google Chrome and Microsoft Edge.
The extension is the core of the attack. Once in place, it hijacks the browsers to steal credentials and session tokens, allowing the operators to bypass authentication without needing to crack passwords directly. By abusing active sessions, the malware can reach banking portals while the victim is still logged in, which makes traditional credential-based defenses far less effective.
Key facts at a glance:
- Tooling: KREMLIN toolkit, delivered via a malicious browser extension
- Threat actor: tracked as REF9334 by Elastic Security Labs
- Active since: at least May 2025
- Targeted browsers: Google Chrome and Microsoft Edge
- Lures: fake pages impersonating around a dozen Brazilian banks
- Impact: theft of credentials and session tokens
Because the campaign depends on user interaction with convincing bank-themed lures, awareness and browser hardening remain the first lines of defense. Organizations and individuals in Brazil should treat unexpected extension install prompts with suspicion and review what is actually running in their browsers.
Source: The Hacker News
Has anyone in the community observed similar bank-impersonation lures or unexpected browser extensions in their environment?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login