KREMLIN Targets Brazilian Banks via Browser Extensions

Cybersecurity researchers announced a previously undocumented operation targeting Brazilian financial institutions. Elastic Security Labs has been tracking the activity under the moniker REF9334, noting it has been active since at least May 2025 when threat actors began luring users with fake bank sites.¹

The malicious campaign uses a toolkit named KREMLIN that delivers a browser extension on Google Chrome and Microsoft Edge, which is installed through deceptive links that impersonate a dozen different Brazilian banks. Once in place, the extension injects itself into the browsers’ processes, allowing the attacker to sideload DLLs or hook APIs used by the browsers for credential handling.¹

Technical analysis shows the malware intercepts keystrokes even when banking websites employ HTTPS encryption. By hooking low‑level API calls inside the browser process, the attackers can capture data before it reaches the network stack, effectively bypassing transport‑layer security measures that would otherwise protect traffic between client and server.¹ This technique mirrors older campaigns such as Zeus (2007) but adds modern sophistication.

Because the extension runs within the user’s own browser context, it can also inject JavaScript directly into banking pages. The injected code acts as a man‑in‑the‑browser attack, capturing credentials and session tokens before they are encrypted by the website.¹

Brazil’s financial system relies heavily on Pix instant payments, which transfer funds immediately rather than over days like traditional wire transfers. A successful exploitation of KREMLIN could therefore move money out of victim accounts almost instantly, magnifying the impact compared with older keylogging trojans that required manual entry after a transaction had already been processed.¹

The campaign demonstrates how threat actors continue to evolve their tactics: using legitimate browsers as vehicles for malicious extensions, exploiting the trust users place in familiar interfaces, and leveraging sophisticated hooking techniques to remain undetected by conventional endpoint protection tools.¹