KREMLIN Malware Uses Ethereum to Update Attack Servers

KREMLIN malware uses Ethereum to update attack servers

KREMLIN malware uses malicious Chrome and Edge extensions plus Ethereum smart contracts, with Elastic tracing 1,515 infected hosts, mostly in Brazil.

KREMLIN Malware Targets Browser Sessions

A new banking malware tracked as KREMLIN is reported hijacking Chrome and Edge to steal credentials and active session tokens. The activity centers on browser compromise rather than simple password collection, giving operators access...

KREMLIN Malware Exposed: Brazilian Banking Operation Uses

A new malware operation targeting Brazilian banks utilizes Ethereum smart contracts for malicious activities. Security teams are on alert.

Chrome and Edge browsers hijacked by KREMLIN malware for credential and token session theft

Elastic Security Labs uncovered REF9334, a Brazilian banking malware campaign active since May 2025Malware “Kremlin” deploys fake docs and malicious Chrome/Edge extensions to steal banking data1,515 infections found, 98% in BrazilSecurity researchers from Elastic Security Labs have discovered a new Brazilian banking malware campaign that uses browser extensions to compromise users and steal sensitive information.In an in-depth report published e…