KREMLIN malware targets users with malicious browser extensions that steal credentials and session tokens. Researchers uncovered the operation in attacks active since at least May 2025. The campaign uses fake banking, invoice, and business documents to start infections. However, the malware later focuses on Chromium-based browsers and their stored data.
The attackers have used lures that imitate several Brazilian financial institutions. Therefore, victims may believe they are opening normal banking documents. The attack then launches a JavaScript loader that downloads additional malware. This multi-stage design helps the attackers hide the final payload from basic security checks.
Multi-Stage Infection Process
The first JavaScript file requires the victim to open it manually. Afterward, the script checks whether the device resembles a sandbox or virtual machine. If the environment looks suspicious, the malware stops running. Therefore, automated analysis systems may struggle to observe the complete infection.
The next stage creates persistence through a scheduled task. It also retrieves download information from an Ethereum smart contract. The malware then downloads additional components from locations supplied by that contract. Finally, it launches the next stage of the attack.
Blockchain Hides Malware Infrastructure
KREMLIN uses blockchain technology to make its infrastructure harder to disrupt. The attackers store changing server information inside Ethereum smart contracts. Therefore, they can update command locations without changing the malware itself. This method can also make traditional domain blocking less effective.
Researchers found that the malware retrieves several pieces of configuration from the blockchain. It then uses those details to locate further components. However, defenders can still examine unusual blockchain activity linked to infected systems. This gives security teams another possible detection point.
Malicious Browser Extensions
One major KREMLIN component installs a malicious browser extension. The extension targets Chromium-based browsers and requests broad access to browser data. For example, it can access tabs, cookies, storage, and web requests. Therefore, the extension can reach information that users normally expect browsers to protect.
The malware uses a known browser integrity bypass technique to install the extension. It modifies browser preference data and creates forged security information. As a result, the malicious extension can avoid some built-in protection mechanisms. The extension then connects to attacker-controlled infrastructure to receive commands.
Credentials and Session Tokens at Risk
Once active, the extension collects information from browser profiles. It can steal cookies and browser storage linked to active websites. Therefore, attackers may obtain session tokens that provide access without directly stealing passwords. This creates a serious risk for banking and other online accounts.
The extension can also collect browser activity and selected page information. For example, it can capture screenshots and retrieve page content. It can also list open tabs and visited domains. However, some claimed collection features may not work because the extension lacks required permissions.
The malware supports several remote commands. These commands can capture browser screens, collect cookies, and inspect active tabs. Attackers can also retrieve webpage content and change certain settings. As a result, the extension gives criminals broad visibility into the victim’s online activity.
Thousands of Systems Show Infection Signs
Researchers recorded 1,515 systems that attempted to contact the network canary domain. More than 98 percent of those systems appeared to be located in Brazil. Therefore, Brazil remains the clearest geographic focus of the observed activity. However, the campaign’s infrastructure could support attacks against other regions.
Researchers linked the operation to at least seven campaigns since June 2025. The attackers previously distributed several remote access trojans and other malware. They later adopted Ethereum smart contracts in May 2026. Therefore, the campaign has continued to change its tools and delivery methods.
How to Prevent KREMLIN Malware
Users should avoid opening unexpected banking or business documents from unknown sources. Organizations should also monitor browser extensions and remove extensions without a clear business purpose. Furthermore, penetration testing can uncover weaknesses that attackers could exploit during targeted campaigns.
Continuous security monitoring can also detect unusual browser activity, suspicious connections, and endpoint behavior. Therefore, combining regular security testing with ongoing threat monitoring can help identify malware before it causes greater damage.
