Cybersecurity researchers have reported on a new banking malware operation, dubbed KREMLIN, which targets users of Google Chrome and Microsoft Edge browsers to steal credentials and session tokens. The operation, tracked by Elastic Security Labs as REF9334, has been active since at least May 2025 and primarily targets Brazilian banking customers through sophisticated social engineering lures.
The KREMLIN toolkit operates by installing a malicious browser extension on the victim's Chrome or Edge browser. This extension is the core mechanism for hijacking browser functionality. Once installed, it can intercept sensitive data such as login credentials entered into banking websites and active session tokens, which could allow attackers to bypass multi-factor authentication and gain unauthorized access to accounts.
The initial infection vector typically involves social engineering tactics. The threat actor impersonates a dozen prominent Brazilian banks, likely through phishing emails, malicious advertisements, or compromised websites, to trick users into downloading and installing the malicious extension. This class of attack often leverages urgency or security alerts to persuade users to take immediate action, leading to the compromise.
Browser extensions, while offering legitimate enhancements, can also be abused if they are malicious or contain vulnerabilities. In this scenario, the KREMLIN extension appears to be purpose-built for data exfiltration, exploiting the trusted position extensions hold within the browser environment to access and manipulate web content and user input. The ability to steal session tokens is particularly concerning, as it allows attackers to maintain persistent access even if victims change their passwords.
Mitigation strategies for this type of threat typically involve a multi-layered approach. Users should exercise extreme caution with unsolicited emails or messages, especially those purporting to be from financial institutions and requesting software installations or credential verification. Verifying the authenticity of such communications directly with the bank through official channels is crucial. Organizations should implement robust email security gateways, endpoint detection and response (EDR) solutions, and user awareness training programs to identify and prevent phishing attempts.
Furthermore, users and organizations should regularly review installed browser extensions, removing any that are unfamiliar or unnecessary. Keeping browsers and operating systems updated to their latest versions helps patch known vulnerabilities that malware might exploit. Implementing strong, unique passwords and enabling multi-factor authentication (MFA) on all sensitive accounts adds an additional layer of security, though session token theft can sometimes bypass MFA if not properly configured.
This incident highlights the ongoing evolution of banking malware, with threat actors increasingly focusing on browser-based attacks that leverage extensions to bypass traditional security measures. The shift towards targeting session tokens rather than just credentials demonstrates a sophisticated understanding of modern web application security and authentication mechanisms, underscoring the need for continuous vigilance and adaptive security practices.
