Overview
- Security researchers at Elastic Security Labs traced a Brazil‑focused campaign tracked as REF9334 and named KREMLIN that has been active since at least May 2025.
- The attack starts when a victim runs a malicious JavaScript file disguised as a bank receipt or invoice, which runs anti‑sandbox checks, downloads components and fetches further payload locations from Ethereum smart contracts.
- KREMLIN forces installation of malicious Chrome and Edge extensions by altering Chromium’s Secure Preferences and regenerating HMACs and encrypted integrity hashes so the browser accepts the add‑ons without user approval.
- Elastic registered an unclaimed domain the malware used for sandbox checks, which caused infected hosts that contacted it to stop progressing and allowed researchers to observe about 1,515 infected systems with roughly 98–99% geolocated to Brazil.
- Defenders can use Elastic’s published IOCs and MITRE mappings to hunt and clean systems, but many machines remain compromised, the malware’s Ethereum contracts were still in use when reported, and operator attribution beyond a likely UTC‑3 work‑hour signal is unconfirmed.