Loading story…
Elastic Security Labs documented REF9334, a Brazil-focused banking-malware operation active since at least May 2025 that delivers the KREMLIN toolkit through Portuguese-language document lures impersonating financial institutions. Multi-stage JavaScript, Node.js, and C++ components use anti-analysis checks, RunPE execution, and SentinelOne DLL sideloading; the campaign has also deployed PULSAR and REMCOS remote-access trojans.
KREMLIN silently installs a malicious Chromium extension named “AVSync System Inc.” by modifying Chrome and Edge Secure Preferences and regenerating browser integrity values. The extension can collect saved credentials, cookies, session tokens, browser storage, page content, screenshots, and keystrokes. Its operators use Ethereum smart contracts as resilient dead-drop resolvers for mutable payload and C2 configuration, alongside Archive.org-hosted JPEG carriers. After researchers registered an unclaimed network-canary domain, 1,515 infected hosts checked in—98.75% of them geolocated in Brazil—before implants identified the environment as a sandbox and halted later-stage activity.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
REF9334 transitioned to Ethereum smart contracts as dead-drop resolvers for dynamically updated payload-hosting and command-and-control locations. Newer infection chains paired the malicious browser extension with REMCOS RAT.
Researchers identified the first full KREMLIN branding in a loader dated February 8, 2026. The loader was version 1.33 and credited an author using the handle Kr3mlin4rt1st.
The September 2025 Framesync campaign used extensions masquerading as FrameSync Driver System and FrameSync Plugin Project, showing the browser-extension capability preceded KREMLIN branding.
REF9334's June 2025 Codecaudiog campaigns delivered PULSAR RAT and, in some variants, malicious browser extensions. The operation was subsequently linked to at least seven campaigns beginning in June 2025.
Elastic Security Labs tracked the Brazilian-focused REF9334 banking-malware operation as active from at least May 2025. The operation used Portuguese-language lures impersonating Brazilian financial institutions to deliver its malware.
Elastic researchers registered the previously unregistered KREMLIN network-canary domain, causing implants that contacted it to treat their environment as simulated and terminate before later stages. They observed 1,515 check-ins, with approximately 98.75% geolocated in Brazil.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 101 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceelastic.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered **ParaSiteSnatcher**, a malicious browser-extension framework targeting Google Chrome and other Chromium-based browsers to steal and manipulate sensitive data from users in Latin America, with a strong focus on Brazil. The malware monitors tabs, injects malicious scripts, intercepts user input, and captures `POST` requests before they are transmitted, allowing it to harvest banking and financial information tied to **Banco do Brasil** and **Caixa Econômica Federal**. It also steals Brazilian tax ID numbers and cookies, including Microsoft account cookies. The framework was also built to interfere with Brazilian payment workflows, including **PIX** transfers and **Boleto Bancario** transactions, giving attackers a way to alter or abuse online payments. Researchers said the malware is delivered through a VBScript downloader hosted on Dropbox and Google Cloud, and observed three downloader variants that added stronger obfuscation, anti-analysis checks, and randomization. Before installation, the downloader verifies that Google Chrome is present and that the victim has a valid `AppData` path, indicating a targeted and evolving campaign.
Aug 14, 2026
Mandiant reported a stealthy intrusion technique that used modified Windows `.lnk` shortcut files to launch legitimate Chromium-based browsers with a malicious extension loaded through the `--load-extension` switch. The approach allowed threat actors to maintain persistence while hiding activity behind normal browser execution, enabling theft of credentials, email data, and cryptocurrency-related information. Mandiant linked the method to multiple financially motivated intrusions in 2023 affecting organizations in the semiconductor, business marketing, financial investment, and telecom sectors. In one investigated campaign, a lure posing as **TradingView Desktop** delivered the **BRAINFOG** dropper, which installed the **RILIDE** browser extension, replaced Chrome shortcuts, and monitored access to services including **Coinbase**, **Binance**, **Gmail**, **Outlook**, **Yahoo Mail**, **Bybit**, and **OKX**. Mandiant also identified **BRAINLINK** as another dropper used to deliver RILIDE through a GitHub-hosted sample, and said infrastructure overlap tied the activity to the RILIDE command-and-control domain `ashgrrwt[.]click` and registrant organization **Kruglova LTD**.
Jun 29, 2026
Security researchers reported multiple **malicious browser-extension** campaigns abusing official extension stores and search-driven lures to compromise enterprise users. Huntress documented a Chrome Web Store extension, **“NexShield – Advanced Web Guardian”** (a near-clone of *uBlock Origin Lite*), distributed via search/advertising redirection and designed to intentionally “freeze” the browser and present a fake **CrashFix** security prompt that instructs users to paste and run commands via `Win + R`; this social-engineering step results in installation of a previously undocumented Windows RAT dubbed **ModeloRAT** on domain-joined endpoints. Reporting also tied the delivery to a traffic distribution system (**KongTuke**, also tracked as **404 TDS/TAG-124** and other aliases) used to profile victims and route them to payload delivery infrastructure that has been leveraged by other criminal operations, including ransomware affiliates. Separately, Socket.dev analysis described **five coordinated Chrome extensions** targeting enterprise SaaS platforms (**Workday, NetSuite, SuccessFactors**) to enable account takeover via **session hijacking**, including continuous token theft and **bidirectional cookie injection** that can bypass MFA by replaying stolen session cookies. In parallel, Malwarebytes reported “sleeper” extension campaigns attributed to **DarkSpectre** (including **GhostPoster** and **ShadyPanda**) that turned previously benign extensions malicious after updates and used **steganography** (JavaScript hidden in extension images) to evade detection across **Edge, Chrome, and Firefox**, with large download counts and long dwell time. A separate Nextron Systems report described a related distribution pattern—malicious “free converter” apps promoted via **malicious Google ads** and made to look legitimate with **code-signing certificates**—highlighting the broader trend of search/advertising-driven initial access leading to persistent RAT deployment, though it is not the same extension-specific incident as the NexShield/CrashFix chain.
Jun 29, 2026