KREMLIN Banking Malware Targets Brazilian Banks

Cybersecurity researchers have identified a previously unknown Brazilian banking malware operating under the name KREMLIN. This malware is associated with a threat group known as REF9334. The activities of this group have been documented since at least May 2025 and aim to steal login credentials and session tokens from users of Brazilian banks. The malware employs a range of deceptions to present itself as legitimate software. In particular, fake websites of over a dozen Brazilian banks are used to lure unsuspecting users into installing a malicious browser extension.

This extension is available for both Google Chrome and Microsoft Edge and allows attackers to access sensitive information. The threat actors behind KREMLIN have specialized in tailoring their attacks to the specific needs and behaviors of Brazilian bank customers. The malware is capable of monitoring users' browser activities and selectively harvesting data while typically running in the background. This technique increases the likelihood that users will unknowingly disclose their login credentials. Another notable feature of KREMLIN is its ability to self-update and modify itself to bypass security measures.

This adaptability makes it difficult for security solutions to detect and neutralize the malware. Researchers from Elastic Security Labs have found that the malware regularly releases new versions to enhance its effectiveness. The spread of this malware has already led to an increase in phishing attacks in Brazil. Security analyses indicate that the number of attacks targeting bank customers has risen by 40% in recent months. Researchers warn that the threat posed by KREMLIN is not limited to Brazil but could also have international ramifications if the malware is not stopped in time.

To protect against KREMLIN, experts recommend installing browser extensions only from trusted sources. Users should also regularly review their account activity and report any suspicious activities immediately. Security authorities in Brazil have already taken measures to curb the spread of the malware and educate the public about the risks. The discovery of KREMLIN is part of a larger trend where cybercriminals increasingly rely on specialized malware to conduct targeted attacks on financial institutions. The threat from such malware is expected to continue rising as more people utilize online banking services.

Security researchers emphasize the need to continuously improve security infrastructure to counter such threats. The KREMLIN malware is an example of the ever-evolving tactics of cybercriminals. Researchers from Elastic Security Labs have already identified several variants of the malware that employ different data collection techniques. This variability poses a significant challenge for the cybersecurity industry. Brazilian authorities have announced plans to work closely with international partners to combat the threat posed by KREMLIN.

Part of this strategy includes training bank employees and raising public awareness about the dangers of phishing and malware. Initial training programs are set to launch next month. The vulnerability exploited by KREMLIN could potentially affect millions of users. Estimates suggest that up to 5 million bank customers in Brazil could be at risk if the malware is not neutralized quickly.

Authorities are urging the public to remain vigilant and report any suspicious activities immediately. The KREMLIN malware represents a serious security risk that requires the attention of security researchers and authorities. The threat could further spread if effective measures are not taken. Researchers from Elastic Security Labs continue to analyze the malware and develop countermeasures.