KREMLIN Banking Malware Bypasses Chrome and Edge Using Ethereum…

The Brazilian KREMLIN toolkit installs malicious extensions on Chrome and Edge by subverting Chromium's Secure Preferences integrity checks, and since May 19, 2026 has used an Ethereum smart contract as a takedown-resistant command-and-control layer.

The Brazilian banking malware KREMLIN, tracked by Elastic Security Labs as REF9334, bypasses native Chromium browser protections to install malicious extensions that steal credentials and session tokens. The campaign, active since May 2025, has reached at least 1,515 systems, over 98% located in Brazil, and on May 19, 2026 adopted Ethereum smart contracts as a takedown-resilient command-and-control infrastructure.

Key Takeaways

KREMLIN manipulates Chrome and Edge's Secure Preferences file with forged HMACs and App-Bound encrypted hashes to install extensions without detection.
The malicious extension 'AVSync System Inc.' communicates via WebSocket and HTTP polling disguised as CSS requests to '/google_api/' endpoints.
The C2 infrastructure relies on the Ethereum smart contract 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b to dynamically update payload URLs.
The initial loader is a JavaScript file posing as a banking document or invoice, executed manually by the victim.

How It Bypasses Chromium Integrity

The technical core of the operation lies in bypassing browser extension integrity protections. KREMLIN does not exploit a zero-day vulnerability in the browser; instead it acts on the persistent configuration of Chrome and Edge, directly manipulating the Secure Preferences file.

According to Elastic Security Labs' analysis, the malware enables developer mode, updates the JSON protection.macs object with forged metadata, and regenerates the HMACs and App-Bound encrypted hashes required to make the extension appear legitimate to Chromium's integrity system. The technique, known as Phantom Extension and GhostChrome-X, has been observed in state espionage operations but is here employed for financial gain.

The resulting extension, named 'AVSync System Inc.' with identifier 'ndpbidppejfanjbhfgjlohfanbfbklff', installs persistently and begins harvesting credentials, session tokens, and sensitive data. The manifest requests access to browsing history, though researchers note it likely fails to collect it due to the missing history permission in the manifest itself.

The Three-Stage Infection Chain

Infection begins with a JavaScript file masquerading as a banking document, invoice, or corporate deed. The victim executes it manually, triggering a multi-stage chain that culminates in the installation of the compromised extension.

The second stage establishes persistence via a scheduled task, queries the Ethereum smart contract to retrieve the updated payload URL, downloads the necessary binaries, and launches the third stage. The C++ installer, 2.10 MB in size, abuses the legitimate SentinelOne binary SentinelMemoryScanner.exe to load the malicious library SentinelAgentCore.dll via DLL sideloading. This technique, also documented in operations by espionage groups such as Seedworm, is repurposed here in a financially motivated criminal context.

Before executing the main payload, the malware performs anti-sandbox checks: it verifies running processes against a hard-coded list, requires at least 2 CPUs and more than 3 GB of RAM. It also includes a canary-check mechanism: it attempts to download a page from an unregistered domain, and if it receives a valid response — indicative of an analysis environment — it deliberately crashes to evade detection.

"So while these systems are still infected with the final component of KREMLIN, this has temporarily degraded and manipulated the campaign's defense mechanisms and could provide defenders with additional time to identify and remediate infected endpoints" — Elastic Security Labs

Ethereum as a Dead-Drop Resolver for C2

The most significant shift, occurring on May 19, 2026, is the adoption of Ethereum smart contracts for command-and-control infrastructure. The address 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b serves as a dead-drop resolver: by querying parameters such as 'sub-module', 'sentinel', and 'main-v2', the malware obtains dynamic URLs for payloads and command endpoints.

This architecture makes the C2 inherently resistant to takedown. Unlike traditional domains or compromised servers, an Ethereum smart contract cannot be easily seized or blocked by a hosting provider. The blockchain offers guaranteed availability and public auditability — qualities that defenders can also exploit: Elastic analyzed transactions and observed they cluster during São Paulo business hours, consistent with an operation run by operators in Brazil.

The malware code and error messages are in Portuguese. The author signs as 'Kr3mlin4rt1st': despite the thematic reference, no infrastructure overlaps currently link the operation to Russian-speaking groups.

Seven Campaigns and the Canary Domain Count

Elastic Security Labs attributes seven distinct campaigns to KREMLIN starting June 16, 2025, documenting progressive technical evolution. The scale of the operation is quantifiable thanks to the researchers' registration of the canary domain: 1,515 infected systems contacted the domain, with over 98% geolocated in Brazil.

The canary registration produced a dual effect. On one hand it gave defenders a metric of spread and an early-warning signal; on the other it temporarily degraded the campaign's defensive mechanisms, giving organizations an additional window to identify and remediate compromised endpoints. The long-term impact on the group's operational capacity is not confirmed, however, as they may adopt new canaries or migrate to alternative infrastructure.

The dossier does not specify the exact nature of data exfiltrated in each campaign, nor the number of victims who suffered concrete financial losses versus those merely infected.

What to Do Now

Organizations managing Windows endpoints should verify the presence of unauthorized browser extensions with suspicious IDs and check scheduled tasks for anomalies. Monitoring traffic to endpoints invoking '/google_api/' patterns with anomalous user-agents or parameters can help identify the disguised communication.

For financial institutions, the priority recommendation is analyzing extensions installed on devices accessing banking services, with particular attention to those requesting elevated page-read or storage permissions. Verifying the integrity of the Chromium Secure Preferences file on suspect endpoints is a specific control suggested by the documented technique.

Network defenders can consider the actively registered canary domain model as a disruption tool: Elastic's observation demonstrates that recognizing and preemptively registering domains used for anti-sandbox checks can degrade the operational capabilities of sophisticated malware campaigns.

Finally, monitoring transactions to the identified Ethereum smart contract offers an open intelligence vector: the blockchain is public, and the malware's interaction patterns leave analyzable traces.

Frequently Asked Questions

Is KREMLIN a Russian operation?

No. Despite the author's chosen handle 'Kr3mlin4rt1st', the operation is Brazilian in origin: the code is in Portuguese, Ethereum transactions cluster around São Paulo business hours, and targeting is concentrated on Brazil. No links to Russian APT groups have emerged.

Can the malware hit Firefox or Safari?

The dossier does not document compatibility with non-Chromium browsers. The bypass techniques would apply specifically to Chrome, Edge, and other Chromium derivatives that implement Secure Preferences and App-Bound encryption.

Why Ethereum and not other blockchains?

The brief does not specify the reason for choosing Ethereum. The source documents only the actual use of Ethereum smart contracts for C2, without comparing technical or economic alternatives.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter