KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens — [https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiPTs6qup
What’s new: A new Brazilian banking malware called KREMLIN has been identified, which hijacks Google Chrome and Microsoft Edge through malicious browser extensions to steal credentials and session tokens. The malware employs multi-stage JavaScript loaders and utilizes Ethereum smart contracts to dynamically update command-and-control (C2) endpoints, making it difficult to disrupt. Active since at least May 2025, KREMLIN’s operation includes evasion techniques against sandbox environments and the ability to harvest extensive browser data.
Who’s affected
Primarily users of Brazilian banking services who may be targeted through phishing lures impersonating various banks. The malware has been linked to over 1,500 infected systems, predominantly located in Brazil.
What to do
- Implement robust endpoint protection solutions to detect and block malicious browser extensions.
- Educate users on the risks of executing unknown JavaScript files and clicking on suspicious links.
- Regularly monitor network traffic for unusual activity, especially related to Ethereum smart contracts.
- Ensure that browser integrity mechanisms are enforced and regularly updated.
