KREMLIN Malware Rewrites Chromium Trust Data to Hijack Brazilian Banking Sessions

A financially motivated malware operation is installing unauthorized Chrome and Edge extensions by reconstructing the integrity data Chromium uses to protect browser profiles. The extensions can capture Brazilian banking credentials, session tokens, and other sensitive information.

Elastic Security Labs tracks the operation as REF9334 and calls the malware ecosystem KREMLIN, a name chosen by its author, Kr3mlin4rt1st. The campaign has been active since May 2025, spanning seven observed campaigns and lures impersonating 12 Brazilian banks.

Elastic published its technical investigation into KREMLIN on September 14, 2026. The operation was subsequently included in a Security Affairs malware roundup published on September 20, 2026.

Despite its name, the campaign has not been attributed to Russia. Portuguese messages and source-code comments, combined with Ethereum transactions concentrated during São Paulo working hours, point instead to a Brazil-focused operation.

A fake document starts a multi-stage Windows infection

KREMLIN infections begin when a user manually runs a JavaScript file disguised as a banking document, invoice, or company-related file. The loader uses limited obfuscation, including generic function names, indexed string tables, bracket notation, and several successive JavaScript stages.

One analyzed initial loader has the SHA-256 hash:

106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42

The script first displays a false error message, encouraging the victim to believe that the supposed document simply failed to open. It creates a temporary script that invokes shell.Popup, then removes it. The filename follows this pattern:

popup_{date}_{random}.js

An additional sample associated with this stage is:

5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552

Before continuing, the loader checks its environment. It counts desktop files and queries Windows Management Instrumentation for the number of running processes. Execution stops when the desktop contains fewer than five files or the system has fewer than 50 processes—conditions commonly associated with newly created analysis environments.

The loader reports these failed checks through:

/api/log_loader?hash=

The analyzed sample contacted:

hxxps://connection[.]upgradeonline[.]site

If the host passes inspection, the first stage downloads a Node.js runtime. It also uses Microsoft’s certutil utility to decode and extract another JavaScript stage, blending the infection chain with legitimate Windows and developer tools.

Persistence hides behind a Node.js updater task

The second stage extracts a scheduled task from an embedded CAB archive. It registers that task under the plausible name:

MicrosoftNodeRuntimeUpdater

The task description refers to the Node.js V8 runtime and Google’s V8 engine, making the entry appear consistent with legitimate software. It runs one minute after user logon and launches:

conhost.exe --headless node.exe

The command executes from the directory containing the malicious script.

This stage also queries an Ethereum smart contract that acts as a dead-drop resolver:

0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b

Rather than embedding fixed download servers in every loader, the operators can change infrastructure information stored through the contract. KREMLIN requests three parameters:

• main-v2, which identifies the primary browser-extension installer.
• sub-module, which points to a JPEG carrying a .NET RunPE injection kit.
• sentinel, which supplies a JPEG containing a CAB archive and SentinelOne executable.

The observed primary installer location was:

hxxps://granderevolucao[.]store/5c92d3b8734b4f498752f735a1ca0987/{campaignId}

The other components were hosted through Archive.org:

hxxps://archive[.]org/download/hotelmoskva/hotelmoskva.jpg
hxxps://ia601808[.]us[.]archive[.]org/5/items/sentinel_20260722_0435/Sentinel.jpg

Elastic did not observe the .NET injector being used in the analyzed activity. Its presence nevertheless shows that the delivery framework can distribute capabilities beyond the browser extension.

Payloads receive additional concealment. The primary module is encoded as reversed Base64, while the JPEG carriers contain Base64 data between file markers. An items.json file inside the SentinelOne-related archive defines what should appear in the installation directory and supports subsequent file replacement.

Forged Chromium integrity values authorize the extension

The central KREMLIN binary is an approximately 2.10 MB x64 C++ executable:

c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268

Its main purpose is to install malicious extensions into Google Chrome and Microsoft Edge. KREMLIN does not merely copy extension files into a browser profile. It alters Chromium preference data and reconstructs the values that would normally reveal unauthorized changes.

The installer manipulates:

• Chromium Secure Preferences.
• Required HMAC integrity values.
• App-Bound encrypted hashes.

This makes the extension appear approved by the user, allowing it to survive Chromium’s profile-integrity checks. Once loaded, it can target banking credentials, browser session tokens, and authenticated banking sessions.

Stealing a valid session token can let an attacker exploit an already authenticated browser state rather than relying only on a captured password. The precise behavior against each impersonated bank has not been disclosed.

No affected Chrome, Edge, or Windows versions have been identified. There is also no CVE, CVSS score, vendor patch, or fixed software release associated with the operation. This is a malware deployment technique, not a disclosed browser vulnerability with a conventional update path.

SentinelOne side-loading and indirect system calls complicate analysis

KREMLIN executes a legitimate SentinelOne component:

SentinelMemoryScanner.exe

That program loads an unsigned malicious library masquerading as:

SentinelAgentCore.dll

This DLL side-loading arrangement allows the payload to run inside a trusted executable’s process context. Defenders should not assume that the presence of a legitimate SentinelOne filename makes the surrounding directory or loaded libraries safe.

During initialization, the malware locates LdrpLoaderLock and LdrpWorkInProgress inside ntdll.dll. It releases the loader lock and clears the work-in-progress state, enabling its worker thread to start before DllMain returns. The behavior bypasses normal Windows loader synchronization and avoids a deadlock that would otherwise occur if initialization code waited on the newly created thread.

KREMLIN also uses indirect system calls. It correlates ntdll.dll exports with address-ordered RUNTIME_FUNCTION entries in .pdata, derives System Service Numbers by counting preceding Zw* exports, and invokes calls through an existing syscall; ret sequence. An embedded stub provides a fallback.

Elastic connected this implementation to the open-source PigSyscall project. The loader-lock manipulation similarly resembles the public LdrLockLiberator technique.

The binary is not heavily obfuscated, and debugging remains enabled in both the installer and extension. Those signs of development immaturity contrast with a comparatively elaborate delivery and configuration infrastructure.

Anti-analysis checks terminate suspicious executions

The native payload examines process names, memory, disk properties, and its host process for signs of security tooling or virtualization. The earlier JavaScript stages add their own desktop-file and process-count tests.

KREMLIN searches for numerous analysis programs, including:

procmon.exe
processhacker.exe
systeminformer.exe
wireshark.exe
windbg.exe
x32dbg.exe
x64dbg.exe
ida64.exe
ghidra.exe
fiddler.exe
frida-helper-64.exe

It also looks for generic sandbox-related names such as malware.exe, sandbox.exe, test.exe, joeboxcontrol.exe, and fakenet.exe.

For many positive detections, the malware intentionally accesses:

0x1337

That invalid address causes an access violation and ends execution in a way that may resemble a crash. Elastic did not observe explicit checks for debuggers or API hooks, although some collected environmental results do not necessarily trigger termination.

Elastic’s kill switch disrupted more than 1,500 infections

Elastic registered a network-canary domain used by the campaign, turning it into a temporary kill switch. The intervention disrupted more than 1,500 infections, with additional affected systems still being counted when the investigation was published.

The canary domain itself has not been disclosed, and the disruption is described as temporary. Organizations should therefore hunt for local evidence rather than treating the intervention as permanent remediation.

High-priority checks include:

• Locate the scheduled task MicrosoftNodeRuntimeUpdater.
• Investigate conhost.exe --headless node.exe, especially from user-writable directories.
• Search endpoint and network telemetry for the three supplied SHA-256 hashes.
• Review Chrome and Edge profiles for unexpected Secure Preferences, HMAC, App-Bound hash, or extension changes.
• Identify unsigned SentinelAgentCore.dll files loaded by SentinelMemoryScanner.exe.
• Flag SentinelOne binaries executed outside approved installation directories.
• Examine suspicious certutil activity involving JavaScript or extracted payloads.
• Hunt for connections to the listed domains and the Ethereum contract address.
• Inspect banking-themed JavaScript files received as invoices, documents, or corporate material.

Users with suspected infections should invalidate active banking sessions and credentials through trusted channels after the affected machine has been isolated and examined. Removing only the visible extension may leave the scheduled task, loader, and side-loaded components intact.