KREMLIN banking malware uses rogue Chrome and Edge extensions
Elastic Security Labs has identified a Brazilian banking-malware operation, tracked as REF9334, that delivers the KREMLIN toolkit through malicious extensions for Google Chrome and Microsoft Edge. The activity has been active since at least May 2025 and has impersonated roughly a dozen Brazilian banks. Elastic registered a network-canary domain used by the malware and observed 1,515 infected systems attempting to contact it; more than 98% were geolocated in Brazil.
KREMLIN is designed to steal credentials, session tokens and other browser data. Its operators use multi-stage JavaScript loaders, custom C++ installers and a malicious extension called AVSync System Inc.. The extension version retrieved by the malware is 1.0.0, with the ID ndpbidppejfanjbhfgjlohfanbfbklff.
Loader chain uses Ethereum for infrastructure updates
The infection begins when a victim manually executes a JavaScript file disguised as a banking, invoice or company document. The loader checks for sandbox and virtual-machine environments before retrieving further stages. Its second stage establishes persistence with a scheduled task, obtains download locations from an Ethereum smart contract, downloads binaries and launches the next component.
The downloaded set includes an extension installer, a .NET PE injector and SentinelMemoryScanner.exe, a legitimate SentinelOne binary. The C++ installer abuses that binary for DLL sideloading, loading an unsigned payload that impersonates SentinelAgentCore.dll. The DLL again checks processes and machine properties, terminating if it finds a hard-coded process name or if the system has fewer than two CPUs and no more than 3 GB of RAM.
The operation moved to Ethereum smart contracts on May 19, 2026. Those contracts act as dead-drop resolvers for changing command-and-control and payload-hosting locations. They also provide two domains, volmira[.]site and zaviro[.]online, which the malware uses to obtain extension information. This infrastructure design makes disruption more difficult because endpoints can receive updated locations dynamically.
Extension bypasses Chromium protections and harvests browser data
To install its extension, KREMLIN uses the publicly documented Phantom Extension and GhostChrome-X approach. It modifies Chromium's Secure Preferences, enables developer mode and forges metadata in the protection.macs JSON object. The technique is notable in the context of browser security fixes and exploit activity because browser security fixes and exploit activity can still be followed by attempts to implant credential-stealing extensions through other routes.
After installation, the extension requests access to tabs, cookies, storage and the webRequest API. It creates a victim identifier in browser storage and communicates with its command-and-control server through WebSocket and periodic requests disguised as CSS fetches. Supported actions include taking screenshots, listing tabs and domains, stealing cookies, sessionStorage and localStorage, extracting active-page HTML, downloading attacker-controlled HTML and refreshing configuration.
The malware also conducts a network-canary check by attempting to download a page from an unregistered domain. If it receives a valid response, it treats that as evidence of simulated network access and deliberately crashes. Elastic's registration of that domain temporarily degraded part of the campaign's defensive mechanism while exposing infected systems attempting the check-in.
Business implication
Security teams should treat unexpected Chromium developer mode, altered Secure Preferences and unapproved extensions as endpoint-investigation signals. On potentially affected devices, organizations should examine extension inventories and scheduled tasks, isolate suspicious endpoints, remove the malicious component and reset browser sessions and credentials that may have been exposed.