Cybersecurity researchers have detailed a previously undocumented banking malware operation from Brazil. The toolkit, named KREMLIN, is designed to hijack Chrome and Edge browsers, giving attackers a way to intercept sensitive data directly from the user's browsing session.
According to the analysis, KREMLIN steals both credentials and session tokens. This allows the operators to bypass login protections and gain persistent access to victim accounts, even after a password is changed.
Elastic Security Labs is tracking the activity under the moniker REF9334. The threat actor has been active since at least May 2025, and the report suggests the operation remains a live concern for users of the targeted browsers.