Kremlin Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Cybersecurity researchers have uncovered a new banking malware operation originating in Brazil that delivers a toolkit known as Kremlin. The malware installs a malicious extension on Google Chrome and Microsoft Edge, allowing it to intercept login credentials and session tokens from victims who browse banking sites.

The campaign, tracked by Elastic Security Labs under the reference REF9334, uses phishing lures that impersonate more than a dozen Brazilian financial institutions. When users download the fake extension, it gains the same privileges as legitimate browser add‑ons, enabling it to silently harvest authentication data.

Active since at least May 2025, the Kremlin toolkit has been observed targeting both desktop and mobile browsers. Its ability to operate across the two dominant browsers increases its reach, and the stolen data can be used for unauthorized transfers or sold on underground markets.

While the current victims are primarily Brazilian, the technique is not limited by geography. Australian organisations and students should be aware that similar malicious extensions could be deployed against local banks or corporate portals, especially as remote work expands the attack surface. Regularly reviewing installed extensions, enforcing strict browser policies, and using multi‑factor authentication are essential safeguards.

For Australian IT professionals looking to strengthen their defensive skills, Wepro Technology offers Security+ and other cybersecurity courses that cover threat analysis, secure configuration of browsers, and incident response, helping participants stay ahead of evolving malware threats.