# Brazilian banking malware hijacks Chrome and Edge browsers

> New campaign uses fake documents to install malicious extensions that steal credentials and session data from bank customers.
- Title: Brazilian banking malware hijacks Chrome and Edge browsers
- Summary: New campaign uses fake documents to install malicious extensions that steal credentials and session data from bank customers. A Brazilian malware campaign…
- Keywords: kremlin malware, ref9334, elastic security labs, chrome, edge, browser extensions, brazil, banking malware, credential theft, ethereum blockchain, session hijacking, cybersecurity
- Source: TechRadar — https://techradar.com/pro/security/chrome-and-edge-browsers-hijacked-by-kremlin-malware-for-credential-and-token-session-theft
- Published: 2026-09-16T10:05:00+00:00
- Read time: 1 min
- Topics: kremlin malware, ref9334, elastic security labs, chrome, edge, browser extensions, brazil, banking malware, credential theft, ethereum blockchain, session hijacking, cybersecurity
## New Brazilian banking malware found
Elastic Security Labs discovered REF9334, a campaign active since May 2025 that uses fake banking and business documents to trick victims into installing malware.
## Malicious browser extensions deployed
The malware, named Kremlin, installs fake extensions in Chrome and Edge browsers. It steals credentials, cookies, session data, and takes screenshots of banking websites.
## Clever tricks to avoid detection
Kremlin checks if it's running in a sandbox and won't execute if detected. It disguises itself as an antivirus addon called AVSync System Inc.
## Uses blockchain to hide communications
Instead of a fixed command server, the malware stores information on the Ethereum blockchain. This makes it much harder to disrupt communication with infected machines.
## Over 1,500 systems infected
Researchers took control of a malware domain and found 1,515 infected systems. Nearly all victims, 98%, were located in Brazil.
## Researchers disrupted the campaign
By registering a canary domain, Elastic made the malware think it was in a sandbox. This prevented infections from progressing past initial access.

> the infections have not moved past the initial access
## Key takeaway

A Brazilian malware campaign called Kremlin uses fake business documents to install malicious browser extensions that steal banking credentials, primarily targeting users in Brazil.