KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Cybersecurity researchers at Elastic Security Labs have uncovered a previously undocumented Brazilian banking malware operation known as KREMLIN, tracked under the activity cluster REF9334. Active since at least May 2025, the threat actor uses lures impersonating over a dozen Brazilian banks to distribute a malicious browser extension targeting Google Chrome and Microsoft Edge. The malware is designed to hijack browser sessions, steal credentials, and capture session tokens from victims. The toolkit represents a sophisticated threat to Brazilian banking customers and financial institutions. The operation highlights the continued evolution of browser-based credential theft techniques employed by Latin American cybercriminal groups.