Cybersecurity defenders are sounding the alarm over a newly analyzed banking malware family operating out of South America. Dubbed KREMLIN by researchers, this sophisticated threat campaign actively hijacks modern web browsers like Google Chrome and Microsoft Edge to siphon sensitive login credentials, financial information, and session tokens directly from victim machines.
Detailed analysis from Elastic Security Labs, which monitors the threat group under the identifier REF9334, reveals an evolving threat landscape where regional cybercriminals are moving away from legacy desktop trojans in favor of stealthy, extension-based browser manipulation. Operating since at least mid-2025, the group has successfully impersonated over a dozen major Brazilian financial institutions, demonstrating a high degree of operational planning and regional targeting.
The Evolution of Latin American Banking Threats
Latin America, and Brazil in particular, has long served as a hotbed for banking trojan development. Historically, threats from this region relied on heavy-handed tactics. Cybercriminals often deployed cumbersome binaries written in Delphi or C++ that took over the victim's screen, injected fake forms into desktop banking applications, or forced system reboots to complete their installation. While effective in the early days of online banking, these traditional trojans suffered from high detection rates. Modern endpoint detection and response (EDR) agents and native operating system protections easily flag suspicious overlay windows and unverified background executables.
To counter these defensive improvements, Latin American threat actors have drastically refined their toolkits over the past several years. Instead of fighting the operating system, actors like REF9334 are targeting the software layer where modern users spend the majority of their time: the web browser. By embedding their malicious logic directly inside browser environments through extensions, attackers effectively operate inside the user's trusted zone.
The KREMLIN campaign underscores this shift. By prioritizing stealth and persistence over brute force system control, the operators behind REF9334 have crafted a modular, highly adaptable attack chain capable of bypassing standard consumer security measures.
Inside the Attack Vector: How KREMLIN Infects Systems
The infection lifecycle for the KREMLIN toolkit typically begins with social engineering tactics designed to exploit user trust. Operators deploy carefully tailored phishing lures—often masquerading as urgent security updates, account verification notices, or official correspondence from prominent Brazilian banks. These messages direct unsuspecting targets to malicious websites that closely mirror legitimate banking portals.
Once a victim interacts with the lure, the primary dropper initiates a multi-stage execution process. Rather than dropping a obvious executable directly onto the desktop, KREMLIN utilizes a series of obfuscated scripts to prepare the host environment. The core component of the attack involves the sideloading or forced installation of a malicious extension into Chromium-based browsers, predominantly Google Chrome and Microsoft Edge.
To achieve this without triggering immediate browser security prompts, KREMLIN tampers with local browser policy configurations and preferences files. It forces the browser to load unpacked extensions or enables developer options covertly. Once installed, the rogue extension operates with elevated privileges within the browser, granting it complete visibility over the target's web traffic, active DOM elements, and cookie stores.
Deep Dive: Browser Hijacking and Token Harvesting
What makes KREMLIN particularly dangerous is its reliance on browser manipulation rather than classic keylogging. Once active inside Chrome or Edge, the extension registers background scripts that monitor network requests and URL navigation in real-time. When the victim navigates to a recognized banking URL or financial portal, the extension triggers its dynamic capabilities.
First, the malware performs DOM (Document Object Model) manipulation. It can seamlessly inject customized, malicious JavaScript into legitimate web pages. When a user attempts to log in to their account, KREMLIN can render convincing fake fields asking for additional sensitive information, such as transaction PINs, personal identification numbers, or one-time passwords (OTPs). Because these fields appear directly within the actual browser tab pointing to the legitimate bank URL, even cautious users are easily deceived.
Second, KREMLIN excels at session token theft. Modern web applications rely on session cookies and tokens to maintain authenticated user sessions, allowing customers to navigate their portals without re-entering credentials on every page. KREMLIN intercepts these tokens directly from the browser's storage engine. By exfiltrating active session tokens back to the attacker's command-and-control (C2) server, the operators can perform session hijacking. This technique allows attackers to impersonate the victim on a remote device, bypassing standard password checks and multi-factor authentication (MFA) prompts entirely.
Furthermore, the extension continuously captures form data, keystrokes inside target input fields, and dynamic page screenshots, sending this stolen intelligence back to C2 infrastructure via encrypted channels to evade network-level inspection.
Why Modern Defensive Layers Struggle
The tactics employed by KREMLIN highlight a growing vulnerability in modern endpoint defenses: the browser as an unmonitored blind spot. Standard antivirus tools excel at analyzing files written to disk or identifying malicious process creation trees. However, when an attack executes entirely inside a legitimate process like chrome.exe or msedge.exe via JavaScript and browser APIs, traditional file scanners often see nothing amiss.
Browser security mechanisms are also under strain. While Google and Microsoft have introduced stricter policies regarding extension distribution—such as Manifest V3 and mandatory Web Store reviews—threat actors routinely find workarounds. By abusing administrative policies, enterprise management registry keys, or developer mode flags, malware like KREMLIN bypasses the official extension stores altogether, installing local packages directly onto host machines.
Additionally, because the malicious actions take place within valid HTTPS sessions targeting legitimate domains, perimeter firewalls and web filters cannot easily distinguish between authorized web requests and exfiltrated credential payloads.
Strategic Implications for the Enterprise and Consumers
While KREMLIN currently focuses its efforts on financial targets across Brazil, the underlying architecture of the malware presents a blueprint for cybercriminals worldwide. The modular nature of browser extension hijacking means that retooling KREMLIN to target North American, European, or Asian financial institutions requires minimal effort—essentially just updating the target URL list and localized web templates.
For enterprise organizations, the rise of campaigns like REF9334 signals an urgent need to harden browser environments across corporate endpoints. Relying solely on EDR agents is no longer sufficient. Security teams must enforce strict group policies that disable developer mode, prevent the installation of non-web-store extensions, and restrict browser policy modifications to authorized administrators.
For consumers, the threat reinforces the necessity of zero-trust behavior when handling online accounts. Users must remain vigilant against unsolicited emails urging immediate account actions, ensure their operating systems and browsers receive timely security updates, and utilize hardware-based security keys or app-based authenticators that offer phishing-resistant MFA, which helps mitigate the risks posed by session token theft.
What Lies Ahead
As security researchers at Elastic Security Labs and across the industry continue to track group REF9334, the battle for browser integrity is heating up. Defensive vendors are increasingly focusing on Endpoint Detection and Response for Browsers (xDR), aiming to provide deeper visibility into runtime JavaScript execution and policy modifications.
KREMLIN represents a clear milestone in the professionalization of regional cybercrime. As financial institutions bolster their network-side fraud detection systems, malware authors will continue refining techniques that exploit the human interface at the edge. Remaining ahead of threats like KREMLIN will require a combination of robust endpoint policies, proactive threat intelligence monitoring, and continuous end-user education.
