Security researchers say the KREMLIN malware campaign has infected at least 1,515 systems, with the vast majority of observed victims located in Brazil, while using Ethereum smart contracts to keep its attack infrastructure current. The operation appears to focus on banking users and relies on malicious browser extensions to steal credentials, cookies and session data.

Elastic Security Labs tracked the activity across seven campaigns and said the attackers adapted both their malware and delivery methods over time. The researchers tied the newer branch to Ethereum contracts that act as a changing address book for command servers and payload locations, allowing operators to redirect infected machines without modifying the malware already running on victims’ systems.

Smart contracts used as a dead-drop resolver

According to Elastic, KREMLIN first incorporated Ethereum into its workflow in May 2026. The first contract the researchers linked to the campaign, traced to May 19, stored configuration values that pointed infected devices to locations hosting the installer and the malicious browser extension. Later versions changed format and eventually shifted to a key-value model that operators could update over time.

Elastic said the latest contract it identified, 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b, was still active when the report was published. Earlier contracts included 0x902EDbFECFF38f285Bf26283fB9cEB3700061873 and 0x64Def0A6099c4DE9C413B108EAae85A3C7457615. The researchers stressed that this does not involve any flaw in Ethereum itself. Instead, infected machines read configuration data from the blockchain to find external infrastructure controlled or abused by the operators.

That design lets the campaign switch domains and hosted files by updating on-chain values rather than rebuilding and redistributing malware. Elastic recorded several such changes, including a main-v2 configuration update on Aug. 13.

Browser extensions installed without store approval

KREMLIN’s browser component targets Chromium-based browsers including Chrome and Edge. Elastic said the installer modifies Secure Preferences data and then regenerates the HMACs and encrypted integrity hashes those browsers expect, making an unauthorized extension appear legitimately registered even though the user never approved it through the official extension store.

The underlying approach predates this campaign. Synacktiv documented a similar technique in 2025 under the name The Phantom Extension, showing how an attacker with access to a Windows machine could alter Chromium preference records and load an extension through internal browser mechanisms. Elastic said KREMLIN turned that method into a tool for financial theft.

In samples analyzed by the researchers, the extension posed as software called AVSync and requested access to tabs, cookies, browser storage and web requests. It was able to collect saved browser data, intercept information during active sessions, and gather databases containing login details, cookies and stored form data before sending the data to attacker-controlled systems.

Distribution focused on Brazilian banking lures

Initial infection still depends on a victim running a malicious file. Elastic said the campaign spreads JavaScript files disguised as receipts, invoices or corporate documents. Once executed, the loader performs environmental checks before moving to later stages of the attack chain.

Recovered samples repeatedly used Portuguese-language filenames and fake error messages, reinforcing the view that Brazil is the primary target. The campaign also impersonated a long list of Brazilian financial brands, including Banco do Brasil, Caixa, Bradesco, Sicoob, C6 Bank, Inter, BTG, Safra, PagBank, PicPay, Santander and Mercado Pago.

Elastic also said the tooling evolved over time. Earlier waves distributed PULSAR RAT, while the Ethereum-linked branch introduced REMCOS RAT together with the custom extension. The researchers identified two related infection chains in this period, including one that uses a legitimate signed SentinelOne executable during loading.

A kill-switch domain exposed the campaign’s scale

Elastic obtained an unusually direct view of the campaign after noticing that KREMLIN checked an unregistered domain as part of an anti-analysis routine. If the domain responded, the malware treated that as evidence it was running in a sandbox and stopped execution. The researchers registered the unused domain and redirected it to infrastructure they controlled.

Compromised machines then began reaching out to that address, allowing Elastic to count 1,515 infected hosts at the time of publication. The total was still increasing, and 98.75% of those systems were geolocated in Brazil. By making the domain resolve, the researchers effectively turned the malware’s own sandbox check against it and temporarily halted progression beyond that infection stage.

Elastic cautioned that the intervention did not remove KREMLIN from affected computers. The machines remained infected, but the canary domain temporarily disrupted the campaign and may give defenders extra time to identify and clean compromised endpoints.

Wallet activity offers attribution clues, not proof

Elastic said on-chain analysis helped connect multiple stages of the operation through a single Ethereum wallet used to deploy malicious contracts and update their settings. The wallet had been active before the first known KREMLIN-linked contract, giving investigators a longer transaction trail to examine.

Between June 19, 2025 and Aug. 24, 2026, the researchers identified 82 USDT transfers tied to that wallet, totaling about 20,778.97 USDT received and 19,016.96 USDT sent. Elastic said those transfers cannot be conclusively labeled as malware-development funding. The timing of much of the activity aligned with working hours in São Paulo’s UTC-3 time zone, which the researchers treated as a possible clue rather than confirmed operator attribution.

Elastic has published indicators of compromise and mapped the activity to MITRE ATT&CK techniques spanning execution, persistence, credential access, browser extensions, command-and-control and data exfiltration. The immediate confirmed next step for defenders is to use those indicators to check endpoint, browser and network telemetry for signs of KREMLIN-related activity.

Source: crypto.news