Most banking malware steals what is already on the disk. The crew Elastic Security Labs tracks as REF9334 does something more patient. It installs its own extension into Chrome and Edge, regenerates the cryptographic seals Chromium uses to detect exactly that, and lets the browser load it as though the user had clicked approve.
Cyril François and Andrew Pease of Elastic Security Labs published a teardown of the toolkit after tracking the operation for 15 months across seven campaigns. The toolkit is called KREMLIN only because its author uses the handle Kr3mlin4rt1st. Nothing about it is Russian: the lures impersonate twelve Brazilian banks, the error messages and code comments are in Portuguese, and the operators' Ethereum transactions cluster during São Paulo working hours.
A scheduled task that claims to be Node.js
The chain starts with a JavaScript file posing as a banking document or an invoice, which the victim runs by hand. It shows an error so the lure appears to have failed, then counts desktop files and running processes. Fewer than five files, or fewer than 50 processes, and it assumes it is in a sandbox and quits.
If it passes, persistence arrives as a scheduled task named MicrosoftNodeRuntimeUpdater and described as Google's V8 JavaScript engine, which survives a casual look. The configuration does not live in the sample: KREMLIN queries an Ethereum smart contract at 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b for its next-stage URLs, a dead drop no takedown can seize. Elastic watched one of those values change on 13 August 2026, mid-analysis.
Chrome's own seal, regenerated
Chromium does not simply trust its own settings files. Extensions registered in a profile's Secure Preferences file carry cryptographic integrity checks, so an attacker who edits that file by hand gets the extension disabled. KREMLIN recovers the keys and regenerates the checks instead. Elastic credits Synacktiv's research, published as "The Phantom Extension", with documenting the technique.
Getting the keys takes some nerve. The malware waits until the browser is closed or the user has been idle for two minutes, force-terminating it if necessary. It then relaunches the browser under a debugger and reads the App-Bound encryption key out of its memory. A seed from resources.pak generates the legacy integrity values, and on Chromium 144 and later an extra encrypted hash is sealed with the recovered key. The malware switches developer mode on, writes the extension into the profile, and updates every check so the browser raises nothing.
The haul is then the browser itself: saved logins, web data, the cookie store and the extensions directory, zipped alongside a keys.json holding both OSCrypt keys so the operator can decrypt it all later.
A kill switch the malware built itself
Before it runs, KREMLIN requests a page from a domain that should not exist, on the theory that a sandbox faking connectivity will answer, at which point it crashes itself. Elastic's Threat Command team registered that domain. By their account it "temporarily disrupted over 1,500 (and counting) infections in this reported campaign", a reminder that the anti-analysis checks attackers bolt on are also attack surface.
Audit browser profiles, not just disks
Tooling that watches for credential files being read will not catch this, because the theft runs through an extension the browser considers legitimate. The check that matters is the profile: unexpected entries under extensions.settings in Secure Preferences, and developer mode switched on where nobody switched it on. A browser that closes and reopens by itself is worth a question. Salient indicators include the extension ID ndpbidppejfanjbhfgjlohfanbfbklff, the hosts volmira[.]site, zaviro[.]online and granderevolucao[.]store, and the mutex ClarinhoQueSim-XEDA2O.
Brazil has been the proving ground for browser-resident bank fraud, from Astaroth hijacking WhatsApp Web to the crews in our Brazil country profile. KREMLIN reaches the same goal through a different door, and what it walks through is the browser's own trust model, not the user's judgment.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.