THREATOPS
THREAT OPS › Threat News › The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

medelastic_securityPublished 2026-09-11

<p>Elastic Security Labs has tracked REF9334, a Brazilian banking malware operation, since May 2025. Its toolkit is called KREMLIN (as named by the malware author, <code>Kr3mlin4rt1st</code>), though nothing about the operation is Russian. Lures impersonate twelve Brazilian banks; error messages and code comments are written in Portuguese, and the operators' Ethereum transactions cluster during Sã

Attributed threat actors

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware