KREMLIN Banking Malware

What happened

KREMLIN is a Chrome/Edge banking trojan that never goes near the Web Store. It installs by directly rewriting a victim's Secure Preferences file and regenerating the HMACs (and, on newer Chrome, the App-Bound encryption hash) that the browser uses to confirm an extension wasn't tampered with — so Chrome itself vouches for a malicious extension it never reviewed. The install chain starts with a phishing lure (a .js file disguised as a document) that drops a PowerShell/C++ installer, which does the preference rewrite and drops the extension.

Once running, it keylogs every <input>/<textarea> via a MutationObserver, intercepts webRequest bodies and headers (so it reads POST data, not just URLs), injects redirects based on DOM selectors, and grabs screenshots, page source, and browser history. Everything is RC4-encrypted (via the undocumented SystemFunction032 API), LZ-string compressed, and shipped over a WebSocket polling once a second — a persistent channel rather than a beacon-and-wait.

The distinctive part is how it finds its C2: an Ethereum smart contract acts as a dead-drop resolver, returning the current C2 config on-chain. Elastic traced the operator wallet moving ~20,778 USDT between June 2025 and August 2026, and correlated Ethereum-transaction timing to São Paulo working hours.

Why it matters here

Every one of the three known extension IDs above is absent from our own catalog, and that's expected, not a detection gap: KREMLIN is never published to the Chrome Web Store or any store we scrape, so it sits entirely outside what a store-scanning pipeline (ours included) can see. It's listed here as a reference entry and an IOC source — the C2 domains/IPs/hashes are seeded into our IOC feed in case any of this infrastructure gets reused by something that does go through a store.

Who's targeted

Portuguese-speaking users, overwhelmingly in Brazil. Phishing lures impersonate twelve Brazilian financial institutions: Banco do Brasil, Bradesco, Caixa, Sicoob, C6 Bank, Inter, BTG, Safra, PagBank, PicPay, Santander, and Mercado Pago.

Timeline

Active since at least May 2025 (first loader upload), rebranded and re-infrastructured repeatedly — Codecaudiog (Jun 2025) → Acrobat installer, no extension (Aug 2025) → Framesync (Sep 2025) → Cremeb, first KREMLIN branding (Dec 2025-Mar 2026) → QR-code variant (Apr 2026) → Ethereum resolver introduced (May 2026) → REMCOS RAT added (Jul-Aug 2026) → publicly disclosed by Elastic Security Labs as REF9334 (2026-09-14), who also registered the kill-switch domain and disrupted 1,500+ infections.