A newly documented malware operation named KREMLIN is quietly rewriting the rules of browser-based credential theft, and despite the name, it has nothing to do with Russian state activity. Researchers tracking the campaign have identified 1,515 infected systems, with 98.75 percent of them located in Brazil, all compromised through a technique that does something most users would assume is impossible: it installs a browser extension on Chrome and Edge that the victim never approved, never saw in a permissions prompt, and cannot easily find by browsing their installed extensions list. The malware’s operators have been refining this approach since at least May 2025, and the most recent evolution of the campaign, which shifted parts of its infrastructure onto Ethereum smart contracts in May 2026, shows just how far attackers are willing to go to keep a credential-theft operation alive against modern defenses.
How KREMLIN Gets Onto a Victim’s Machine
The infection chain starts with social engineering tailored specifically to Brazilian victims. Lures are written in Portuguese and impersonate Brazilian banks and payment services, typically framed as invoices, payment confirmations, or account records. Once a victim opens the malicious JavaScript document attached to one of these lures, the malware installs its components and begins targeting any Chrome or Edge browser profile present on the machine.
What sets KREMLIN apart from ordinary info-stealer malware is how it gets its malicious extension past the protections both Chrome and Edge have built specifically to stop exactly this kind of attack. Modern Chromium-based browsers are supposed to prevent unsigned or unapproved extensions from silently installing themselves; KREMLIN’s operators have found a way to plant the extension while forging the browser’s own integrity checks, so the browser effectively vouches for code the user never agreed to run. That single technical detail, defeating platform-level extension integrity controls rather than just tricking a user into clicking “install,” is why security researchers have treated this campaign as more than routine banking malware.
What the Malicious Extension Actually Steals
Once installed, the rogue extension operates with the same access any legitimate browser extension has to the pages a victim visits, which for a banking trojan is more than enough. It is designed to harvest saved passwords, active session cookies, and other authentication material that lets the operators walk directly into a victim’s online banking session without needing the password at all. Session-cookie theft in particular is a technique that increasingly bypasses multi-factor authentication entirely: if an attacker steals a live, already-authenticated session token, the second factor the victim entered earlier is irrelevant, because the attacker is riding the same authenticated session rather than trying to log in from scratch.
This is the same fundamental weakness that has driven a broader industry shift toward monitoring session integrity, not just login events, as a security control. An organization that only watches for suspicious login attempts and ignores anomalous activity on already-authenticated sessions has a structural blind spot that campaigns like KREMLIN are specifically built to exploit.
Why the Ethereum Smart Contract Pivot Matters
Earlier versions of the KREMLIN campaign delivered additional remote access tools alongside the malicious extension and relied on more conventional command-and-control infrastructure, the kind of server or domain that defenders can eventually identify, sinkhole, or get taken down. The May 2026 shift to hosting configuration data on Ethereum smart contracts changes that calculus significantly. A blockchain-hosted configuration cannot be seized or taken offline the way a traditional command-and-control domain can. Combined with a newly added technique that uses a legitimately signed security-program component to load an unsigned malicious file, riding on the trust that signed software normally carries, the campaign’s newest iteration is measurably more resilient to takedown efforts than its earlier versions.
This pattern, borrowing legitimate infrastructure and legitimate trust signals rather than building obviously malicious infrastructure from scratch, is becoming a defining feature of financially motivated malware in 2026. It is also precisely the kind of evasive, multi-stage behavior that static antivirus signatures and simple domain blocklists struggle to keep up with, because by the time a blocklist catches up to one piece of infrastructure, the operators have already rotated to another legitimately-hosted component.
Why the Name Is Misleading
Despite the name, researchers have found no meaningful evidence tying KREMLIN to Russian state activity. The campaign’s language, its exclusively Brazilian bank-themed lures, and its infection patterns all point toward a financially motivated operation focused specifically on the Brazilian market rather than anything geopolitically motivated. It is a useful reminder that malware family names are chosen by researchers for convenience, sometimes based on strings found in the code or the tooling used, and are not attribution claims. Treating a name like “KREMLIN” as evidence of nation-state involvement, without the underlying technical attribution to back it up, is exactly the kind of assumption that leads security teams to misjudge both the threat actor’s intent and their likely next move.
Why This Should Worry More Than Just Brazilian Banks
It would be a mistake for security teams outside Brazil to read this as a regional curiosity and move on. The techniques KREMLIN has proven out, forging browser extension integrity checks, hosting configuration on an unseizable blockchain, and riding signed software to load unsigned payloads, are all fully portable to any target market and any brand. Financially motivated malware operators are notorious for reusing a technique that works against a new region or industry once the original campaign has been documented and the novelty value of the underlying weakness is already public. Any organization whose customers or employees authenticate through a browser, which is effectively every organization, should treat KREMLIN’s toolkit as a preview of techniques likely to show up against their own users within the next development cycle, not a problem confined to one country.
What Organizations and Individuals Should Do
- Do not assume the presence of an unfamiliar extension will show up cleanly in the browser’s own extension management page. Enterprises should deploy endpoint tooling capable of independently enumerating installed browser extensions rather than trusting the browser’s self-reported list.
- Treat session-cookie theft as seriously as password theft in your detection strategy. Monitor for session reuse from unexpected geographies or device fingerprints, not just failed or suspicious login attempts.
- Train employees and customers specifically on Portuguese-language (or locally translated) invoice and payment-confirmation lures if you operate in or serve the Brazilian market, since social engineering remains the actual entry point regardless of how sophisticated the payload is.
- Audit how your organization trusts signed software components, since KREMLIN’s newest variant specifically abuses that trust chain to load unsigned malicious code.
- Commission an independent penetration test that specifically includes browser and endpoint attack paths, not just server-side application testing, since credential and session theft increasingly happens client-side, outside the boundary most traditional pentests scope in.
Frequently Asked Questions
Is KREMLIN malware connected to the Russian government?
No. Researchers have found no technical evidence linking the campaign to Russian state activity. The name refers to a string or artifact researchers found in the malware’s code, not an attribution finding, and every indicator points to a financially motivated group focused on Brazilian banking customers.
How can a malicious browser extension install without the user approving it?
KREMLIN’s operators found a way to forge the integrity checks Chrome and Edge use to verify that an extension is legitimate before allowing it to run, effectively tricking the browser into trusting code the user never explicitly approved. This is a platform-level evasion technique, not a simple case of a user clicking through a permissions prompt.
Does multi-factor authentication protect against this kind of attack?
Not reliably. Because KREMLIN steals live session cookies rather than just passwords, an attacker can reuse an already-authenticated session without ever needing to pass through a login or MFA challenge again. Defending against this requires monitoring session behavior itself, not just login events.
Why does hosting configuration on Ethereum make this malware harder to stop?
Traditional command-and-control infrastructure, servers and domains, can be identified, seized, or blocked by defenders and law enforcement. Data written to a public blockchain is effectively permanent and cannot be taken down the same way, which gives the malware operators a resilient, censorship-resistant channel for distributing updated configuration to infected machines.
Getting Expert Help
Credential and session-theft campaigns like KREMLIN succeed because they target the gap between what a browser shows a user and what is actually running underneath it, a gap that most security programs never test directly. If your organization needs a genuine, adversarial evaluation of how resilient your applications and infrastructure are against this kind of client-side and identity-focused attack, SecurityLab.Pro’s penetration testing team can assess the full picture, from web application logic to session handling. Businesses working with AI-integrated platforms, where a stolen session can carry even more privilege, should also look at AgentOffense, and organizations based in Cyprus or the broader EU looking for a local penetration testing partner can turn to CyprusPentest. Campaigns like this one do not stay confined to their original target market for long, and the organizations that test for these techniques before they arrive are the ones that do not end up in next year’s breach statistics.