KREMLIN Malware Uses Ethereum Smart Contracts and Rogue Browser Extensions to Drain Brazilian Bank Accounts
A newly documented Brazilian banking malware operation has been quietly targeting customers of over a dozen Brazilian financial institutions since at least mid-2025. Elastic Security Labs, tracking the campaign as REF9334, has published a technical breakdown of the toolkit at its core: something they're calling KREMLIN.
The setup is more sophisticated than most banking malware you'll encounter. Rather than relying on static command-and-control infrastructure that defenders can simply block, KREMLIN routes its C2 lookups through Ethereum smart contracts. The attackers update payload hosting locations and C2 endpoints dynamically via blockchain, meaning there's no central server to take down. It's a clever abuse of decentralised infrastructure that's going to give incident responders a headache.
Infection begins with a JavaScript file dressed up as a bank statement, invoice, or business document. The victim runs it manually. From there, a multi-stage loader kicks off, but only if it's satisfied it isn't running inside a sandbox or virtual machine. If the environment passes inspection, it downloads further payloads and proceeds to stage two.
Stage two does four things: sets up persistence via a scheduled task, queries the Ethereum smart contract for download URLs, fetches the next set of binaries, and launches stage three. The payloads it pulls down include a malicious browser extension installer, a .NET PE injector, and a legitimate SentinelOne binary named SentinelMemoryScanner.exe. That last one is there purely to be abused.
The custom C++ installer sideloads its unsigned main payload through the SentinelOne binary by impersonating SentinelAgentCore.dll. Once running, the DLL repeats the environment checks from earlier, scanning active processes and inspecting hardware properties. Fewer than two CPUs or less than 3GB of RAM? The malware shuts itself down. Sensible operational security, if nothing else.
KREMLIN also queries the same Ethereum contract to retrieve two domains and uses these to fetch the browser extension's version number and ID. The extension, masquerading under the name 'AVSync System Inc.', is downloaded as a ZIP archive and installed only if it isn't already present or if a newer version is available server-side.
Installing an unauthorised extension without triggering Chrome's built-in protection is the kind of thing that should be difficult. KREMLIN gets around it using a publicly known technique that manipulates the Secure Preferences file, enables developer mode, and forges the HMAC metadata in the protection.macs JSON object. This same approach was used by APT31 in a campaign from late August 2026 that deployed a credential-stealing extension called GemStone via the BlueMoon exploit kit.
Once installed, the extension requests access to tabs, cookies, storage, and the webRequest API, generates a unique victim identifier, and begins shipping browser data to a C2 server over port 443. It communicates via WebSocket and supports a range of commands: taking screenshots, enumerating tabs, stealing cookies and session storage, pulling full page HTML, and downloading attacker-controlled HTML replacements.
Beyond WebSocket, the extension polls a /google_api/ endpoint at regular intervals, disguising requests as CSS file fetches. Each fake CSS path maps to a specific exfiltration task, covering everything from cookie theft and browser history to intercepted HTTP requests and screenshot uploads. It's a reasonably well-engineered covert channel.
The group behind KREMLIN has been active since at least June 2025 and has run seven distinct campaigns since then. Earlier activity included distributing off-the-shelf remote access tools like Pulsar RAT and Remcos RAT. The switch to Ethereum-based infrastructure appears to have happened on 19 May 2026.
Elastic's researchers found one particularly useful foothold. KREMLIN includes an anti-sandbox check where it attempts to download content from an unregistered domain. If it gets a valid response, it assumes it's inside a simulated network environment and crashes deliberately. Elastic registered that canary domain themselves and watched the connection attempts roll in: 1,515 infected systems checked in, with over 98% geolocated to Brazil.
By controlling the canary domain, Elastic can now send infected machines into a crash loop, temporarily degrading the malware's defences. It buys defenders more time to identify and clean up compromised endpoints. It won't last, but it's a neat bit of counter-infrastructure work while it holds.