Security researchers have traced more than 1,500 KREMLIN malware infections after uncovering a Brazilian banking campaign that uses Ethereum smart contracts to update attack infrastructure and malicious browser extensions to steal credentials and session data.
Summary
- Elastic tracked KREMLIN across seven campaigns using malicious browser extensions against Brazilian banking users primarily.
- Ethereum smart contracts let KREMLIN operators update command servers and payload locations without changing malware.
- Elastic observed 1,515 infected systems contacting its registered canary domain, with 98.75% located in Brazil.
- KREMLIN manipulates Chromium Secure Preferences to install malicious Chrome and Edge extensions without user approval.
- Researchers traced 82 USDT transfers through the wallet used to deploy and update malicious contracts.
Elastic Security Labs disclosed the operation in a Sept. 14 technical report after tracking the activity under REF9334 since May 2025. Researchers followed seven campaigns over roughly 15 months and linked the latest versions to Chrome and Microsoft Edge extensions capable of collecting browser credentials, cookies, session tokens and other sensitive information.
SlowMist issued a threat-intelligence alert on Sept. 16 drawing attention to the blockchain component of the operation, including three Ethereum contracts linked to changing command-and-control infrastructure.
Despite the name KREMLIN, Elastic said it found no evidence connecting the campaign to Russia. The toolkit name comes from the malware author’s handle, while the lures impersonate Brazilian banks, use Portuguese-language text and overwhelmingly reach systems located in Brazil.
KREMLIN uses Ethereum contracts as changing address books
Ethereum entered the operation in May 2026, when researchers observed the first malicious smart contract tied to KREMLIN’s infrastructure.
Elastic traced the first contract to May 19. It stored configuration values pointing infected systems toward locations used for the installer and malicious browser extension. Later contracts changed the structure and eventually moved to a key-value configuration model that could be updated by the operator.
The current contract identified by Elastic is 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b. Researchers said it remained in use when their report was published. Earlier contracts included 0x902EDbFECFF38f285Bf26283fB9cEB3700061873 and 0x64Def0A6099c4DE9C413B108EAae85A3C7457615.
The contracts do not represent an exploit of Ethereum’s consensus system or smart-contract platform. Elastic found that the attackers used the blockchain as a dead-drop resolver: infected machines read configuration values from the contracts to locate external infrastructure controlled or abused by the operators.
Such a design lets operators change infrastructure references by updating on-chain values while leaving the initial malware unchanged. Elastic recorded contract updates pointing toward different domains and hosted files, including a main-v2 configuration change on Aug. 13.
Crypto.news reported in 2025 that malicious npm packages were using Ethereum smart contracts to retrieve command infrastructure. ReversingLabs researchers described a comparable model in which blockchain data contained locations used to reach attacker-controlled servers.
Microsoft found ClickFix campaigns using BNB Chain smart contracts to retrieve malware instructions. Microsoft’s findings involved a separate campaign but showed another example of public blockchains being used as infrastructure for malware configuration.
Malicious extensions can enter Chrome and Edge without approval
KREMLIN’s browser component uses a technique that lets an unauthorized extension appear properly registered inside Chromium-based browsers.
Elastic said the installer modifies Chrome or Edge’s Secure Preferences data and regenerates the HMACs and encrypted integrity hashes the browser expects. Once those values match, the malicious extension can load even though the user never approved an installation through the official extension store.
The technique itself predates the KREMLIN campaign. Security firm Synacktiv documented the approach in 2025 under research titled The Phantom Extension, showing how an attacker with access to a Windows system could alter Chromium preference records and load an extension through internal browser mechanisms.
KREMLIN operationalized that technique for financial theft. Elastic’s analyzed extension masqueraded as software called AVSync and requested access to tabs, cookies, browser storage and web requests. It could collect saved browser data and intercept information during active web sessions.
The malware gathers browser databases containing login information, cookies and stored form data. Elastic found that it acquired encryption material needed to access protected browser data before sending collected information to attacker-controlled infrastructure.
Initial infection still requires execution of a malicious file. Elastic said the campaign distributes JavaScript files disguised as bank receipts, invoices or corporate documents. Once a victim executes the lure, the loader checks the environment before progressing through later stages.
Brazilian financial brands impersonated in campaign material included Banco do Brasil, Caixa, Bradesco, Sicoob, C6 Bank, Inter, BTG, Safra, PagBank, PicPay, Santander and Mercado Pago.
Elastic counted 1,515 infected hosts after disrupting a kill switch
Elastic gained an unusually direct measure of the campaign’s reach after researchers noticed that KREMLIN checked an unregistered internet domain as part of its anti-analysis process.
The malware was designed to test whether the domain responded. A successful response caused the program to assume it was operating inside an analysis sandbox and terminate itself. Elastic registered the previously unused domain and pointed it to infrastructure the researchers controlled.
Registering the domain turned KREMLIN’s own anti-analysis check against the campaign. Machines reaching the domain interpreted the response as evidence of a sandbox and stopped progressing through the infection chain.
Elastic cautioned that the intervention was temporary. “This has temporarily degraded and manipulated the campaign’s defense mechanisms,” the researchers wrote, saying the interruption could give defenders more time to locate and clean affected endpoints.
The systems remained infected, meaning the registration did not automatically remove KREMLIN from compromised computers. Elastic’s report said the affected machines had been prevented from moving beyond the relevant infection stage while the canary remained effective.
The geographic data supports the researchers’ earlier assessment that Brazil is the campaign’s primary target. Portuguese-language filenames, fake error messages and Brazilian financial brands appeared repeatedly across the recovered samples.
Ethereum wallet activity links multiple KREMLIN campaigns
On-chain analysis helped Elastic connect different stages of the malware operation. Researchers identified a single Ethereum wallet used to deploy malicious contracts and update their configurations. The address was financially active before the first KREMLIN-linked contract appeared, giving investigators a transaction trail spanning more than a year.
Between June 19, 2025, and Aug. 24, 2026, Elastic identified 82 USDT transfers associated with the wallet. The recorded activity totaled approximately 20,778.97 USDT received and 19,016.96 USDT sent. Researchers said individual transfers could not be conclusively classified as malware-development funding.
Transaction timing provided another attribution clue. Elastic found that much of the wallet activity lined up with working hours in the UTC-3 time zone used by São Paulo, although the researchers presented Brazil as a plausible operator location instead of a confirmed attribution.
The campaign has changed tooling during its lifespan. Earlier waves distributed PULSAR RAT, while the newer Ethereum-linked branch introduced REMCOS RAT alongside the custom browser extension. Elastic identified two related chains during this period, including one that uses a legitimate signed SentinelOne executable as part of the loading process.
Security teams can use the indicators published by Elastic Security Labs and its accompanying public IOC repository to check endpoint, browser and network telemetry for artifacts tied to the campaign. Elastic mapped the activity to MITRE ATT&CK techniques covering execution, persistence, credential access, browser extensions, command-and-control and data exfiltration.
Brazilian crypto users were targeted by separate WhatsApp-distributed malware in late 2025. That campaign targeted banking, fintech and cryptocurrency credentials but was not linked to REF9334.
Elastic’s latest published blockchain timeline shows KREMLIN’s contract configuration being modified through August, while its infrastructure observations extend into late August 2026. The researchers said the 0xCD7360…d07b Ethereum contract remained in use when the Sept. 14 report was prepared.
