KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Elastic Security Labs disclosed Brazilian banking malware KREMLIN (group REF9334), active since at least May 2025. A malicious extension for Chrome and Edge steals credentials and session tokens, masquerading as sites of a dozen Brazilian banks.
- Campaign REF9334 active since at least May 2025
- Lures imitate sites of about a dozen Brazilian banks
- Extension for Chrome and Edge steals passwords and session tokens
Read next
Security