[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQyYwQLXDqrpr1B8tOcloOYO97H3X8EwLI-dGsGdEOk0":3},{"article":4,"iocs":48,"watch_terms":55,"solutions":56,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"391d8f92-1f15-4235-a7e2-b9ade1b89c38","KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens","kremlin-banking-malware-hijacks-chrome-and-edge-to-steal-credentials-and-session-e6910d","Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that impersonate a dozen Brazilian banks and install a malicious browser extension on Google Chrome and","A new Brazilian banking malware operation, tracked as REF9334 and dubbed KREMLIN, is actively stealing credentials and session tokens from users of Google Chrome and Microsoft Edge. The malware employs multi-stage JavaScript loaders, custom installers, and malicious browser extensions that bypass security mechanisms. Notably, it leverages Ethereum smart contracts to dynamically update C2 infrastructure, making it resilient to disruption.","KREMLIN banking malware targets Brazilian users, stealing credentials via malicious browser extensions.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fkremlin-banking-malware-hijacks-chrome.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiPTs6qupSdjinGg233zkoldOvlD4cva51loWufV3l9GrlDopNRIKsV9yluCDjbGELBAAvVGx_h4R-sjx4jvDp290Znzhv6j546sq5JB0NJUShGVV3w0gKU7nu4dBVCosaPeKW-Pr1_WHn4FV26aEJRgEo7oSJsgUE5_ZGCMKWPPBdZ7NMh5XRr04Cs6qTh\u002Fs1600\u002Fbrowser-malware.jpg","2026-09-15T18:54:14+00:00","2026-09-15T20:00:36.002415+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"REF9334","threat_actor",{"name":21,"type":22},"Google Chrome","product",{"name":24,"type":22},"Microsoft Edge",{"name":26,"type":27},"Ethereum","technology",{"name":29,"type":19},"APT31","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53],{"type":50,"value":51,"context":52},"domain","volmira[.]site","Command and control domain used to fetch browser extension details.",{"type":50,"value":54,"context":52},"zaviro[.]online",[21,24],{"controls":57,"vendors":134},[58,79,105],{"slug":59,"name":60,"problem":61,"products":62},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[63,71],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":80,"name":81,"problem":82,"products":83},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":101,"product_name":102,"url":103,"description":104},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[135,141,147],{"slug":136,"name":137,"logo_path":138,"roles":139},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png",[140],"reported_by",{"slug":142,"name":143,"logo_path":144,"roles":145},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[146],"affected",{"slug":64,"name":65,"logo_path":66,"roles":148},[146],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":168},"kremlin-banking-malware-hijacks-browsers-to-steal-credentials-via-malicious-extensions","KREMLIN Banking Malware Hijacks Browsers to Steal Credentials via Malicious Extensions","The KREMLIN malware campaign exploits users through multi-stage JavaScript loaders and malicious browser extensions that bypass built-in security mechanisms in Chrome and Edge, ultimately harvesting credentials and session tokens. A particularly sophisticated aspect is its use of Ethereum smart contracts as a decentralized command-and-control (C2) channel, making traditional domain-blocking and takedown efforts largely ineffective. This highlights a dangerous gap where users unknowingly install or permit malicious extensions, and organizations lack visibility into browser-level threats. The theft of session tokens is especially critical because it enables attackers to bypass multi-factor authentication entirely, granting full account access without needing passwords. This campaign underscores that browser hygiene and endpoint monitoring are now frontline security concerns.",[154,155,156,157,158,159,160,161,162,163,164,165,166,167],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 SC-18: Mobile Code","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF DE.CM-4: Malicious Code Detection","MITRE ATT&CK T1176: Browser Extensions","MITRE ATT&CK T1539: Steal Web Session Cookie","MITRE ATT&CK T1568: Dynamic Resolution (C2 via Blockchain)","GDPR Article 32: Security of Processing (credential\u002Fdata theft impact)","ITIL: Incident Management — Response to credential compromise events",{}]