Researchers detail KREMLIN banking-malware operation in Brazil

Elastic Security Labs reported a Brazilian banking-malware operation it calls REF9334, which delivers the KREMLIN toolkit through lures impersonating Brazilian banks. Researchers said the malware installs malicious Chrome and Edge extensions to steal credentials, session tokens and other browser data. The operation uses Ethereum smart contracts to update command-and-control endpoints and payload locations. Elastic said it identified 1,515 infected systems checking a registered canary domain, with more than 98% geolocated in Brazil.