KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

The KREMLIN malware campaign exploits users through multi-stage JavaScript loaders and malicious browser extensions that bypass built-in security mechanisms in Chrome and Edge, ultimately harvesting credentials and session tokens. A particularly sophisticated aspect is its use of Ethereum smart contracts as a decentralized command-and-control (C2) channel, making traditional domain-blocking and takedown efforts largely ineffective. This highlights a dangerous gap where users unknowingly install or permit malicious extensions, and organizations lack visibility into browser-level threats. The theft of session tokens is especially critical because it enables attackers to bypass multi-factor authentication entirely, granting full account access without needing passwords. This campaign underscores that browser hygiene and endpoint monitoring are now frontline security concerns.